The company is about to upgrade a financial system through a third party, but wants to legally ensure that no sensitive information is compromised throughout the project. The project manager must…

Separation of duties ensures no single individual has end-to-end control over a sensitive process, directly meeting the requirement to mitigate damage from one person's actions - for example, requiring two people to authorize financial transactions.

Forensic tasks are reactive investigative activities performed after an incident, not preventive legal or procedural controls.

A Memorandum of Understanding (MOU) expresses a general intent to cooperate but is typically not legally binding and does not specifically protect sensitive data.

An Operational Level Agreement (OLA) defines internal service delivery commitments between departments and does not address third-party confidentiality or insider threat mitigation.

A Non-Disclosure Agreement (NDA) is a legally binding contract that obligates the third party to protect sensitive information from unauthorized disclosure, directly satisfying the requirement to legally ensure no sensitive data is compromised during the project.

Job rotation reduces fraud risk over time by cycling employees through roles, but it does not prevent a single individual from causing damage during the period they hold a given role.