CAS-005 Question #138: Real Exam Question with Answer & Explanation

Question

A global organization is reviewing potential vendors to outsource a critical payroll function. Each vendor's plan includes using local resources in multiple regions to ensure compliance with all regulations. The organization's Chief Information Security Officer is conducting a risk assessment on the potential outsourcing vendors' subprocessors. Which of the following best explains the need for this risk assessment?

Options

• ARisk mitigations must be more comprehensive than the existing payroll provider.
• BDue care must be exercised during all procurement activities.
• CThe responsibility of protecting PII remains with the organization.
• DSpecific regulatory requirements must be met in each jurisdiction.