The company is about to upgrade a financial system through a third party, but wants to legally ensure that no sensitive information is compromised throughout the project. The project manager must…

Separation of duties divides critical tasks among multiple individuals so that no single person has the ability to perform, authorize, and conceal a damaging action, directly mitigating the risk of one individual causing significant harm during the financial system upgrade.

Forensic tasks are investigative procedures conducted after a security incident has occurred and do not prevent data compromise or limit individual access during a project.

A Memorandum of Understanding (MOU) documents a general agreement between parties but is not legally binding and therefore does not legally ensure sensitive information is protected.

An Operational Level Agreement (OLA) defines service levels between internal teams and does not address legal confidentiality with external third parties.

A Non-Disclosure Agreement (NDA) is a legally binding contract that obligates the third-party vendor and its personnel to keep all sensitive organizational information confidential, directly satisfying the legal requirement to prevent information compromise.

Job rotation is a long-term internal control that reduces fraud risk over time but does not directly address the immediate legal requirement to protect information shared with a third party.