CRISC Question 270

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  C. organization's business process manager While the service provider has certain responsibilities in maintaining the application and ensuring its security, the risk associated with the use of the service is still owned by the organization that outsourced the application. Specifically, the business process manager (or owner) within the organization typically takes ownership of risks associated with the processes they oversee, which includes decisions to outsource certain elements of those processes.

• Chose C1

  You may outsource process but you still are responsible

• Chose D1

  Sorry 'D'.