CISM Question 265

Question

When defining and communicating roles and responsibilities between an organization and cloud service provider, which of the following situations would present the GREATEST risk to the organization's ability to ensure information risk is managed appropriately?
A. The service agreement uses a custom-developed RACI instead of an industry standard RACI to document responsibilities
B. The organization believes the provider accepted responsibility for issues affecting security that the provider did not accept
C. The organization and provider identified multiple information security responsibilities that neither party was planning to provide
D. The service agreement results in unnecessary duplication of effort because shared responsibilities have not been clearly defined

Accepted Answer

Marked answer: B. The organization believes the provider accepted responsibility for issues affecting security that the provider did not accept

CISM Question 265

Community Discussion

Preparing Practice Exam…

CISM Question 265

Community Discussion