CRISC: Certified in Risk and Information Systems ControlDemo

Question

An organization has migrated its payroll system to a Software as a Service (SaaS) application. A new data privacy regulation requires that data be processed only within the country in which it is collected. Which action should be taken FIRST to address this situation?

A Analyze data protection methods.
B Understand data flows.
C Include a right-to-audit clause.
D Implement strong access controls.

Explanation

Data-flow mapping establishes where payroll data travels and is processed, including processing performed by the SaaS provider and any subprocessors. This is required to determine whether the country-specific processing requirement is met and what remediation is needed.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ952

Community Discussion