Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Risk is second level. They provide oversight, guidance and monitoring. They never own or operate IT controls. And the organization retains accountability for the risk plus controls, not the vendor.
I agree it should be D.
D. According to ISACA, when an organization outsources its IT security management function to an external service provider, the service provider’s IT security function is the best party to own the IT security controls under this arrangement. The service provider’s IT security function should be responsible for ensuring that the organization’s IT security controls are implemented and maintained in accordance with the agreed-upon service level agreements (SLAs) .