Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
By ISACA standard, anything that involves a third-party supplier is considered as transfer of risk.
A. transfer Engaging a third party to handle a specific security function, such as providing an Internet gateway encryption service, is a form of transferring the responsibility of managing and maintaining that function. While the organization still retains the ultimate responsibility for the risk, they've transferred the operational responsibility to the third party. Thus, this is an example of risk transfer.
The whole concept of transferring is convoluted as the ownership of risk rests the outsourcer.