CAS-005 · Question #138
A global organization is reviewing potential vendors to outsource a critical payroll function. Each vendor's plan includes using local resources in multiple regions to ensure compliance with all…
The correct answer is C. The responsibility of protecting PII remains with the organization. The responsibility for protecting PII remains with the organization, even when outsourcing to third- party vendors or subprocessors. Conducting a risk assessment ensures that these subprocessors maintain adequate security controls to protect sensitive data and meet compliance…
Question
A global organization is reviewing potential vendors to outsource a critical payroll function. Each vendor's plan includes using local resources in multiple regions to ensure compliance with all regulations. The organization's Chief Information Security Officer is conducting a risk assessment on the potential outsourcing vendors' subprocessors. Which of the following best explains the need for this risk assessment?
Options
- ARisk mitigations must be more comprehensive than the existing payroll provider.
- BDue care must be exercised during all procurement activities.
- CThe responsibility of protecting PII remains with the organization.
- DSpecific regulatory requirements must be met in each jurisdiction.
How the community answered
(58 responses)- A14% (8)
- B7% (4)
- C76% (44)
- D3% (2)
Explanation
The responsibility for protecting PII remains with the organization, even when outsourcing to third- party vendors or subprocessors. Conducting a risk assessment ensures that these subprocessors maintain adequate security controls to protect sensitive data and meet compliance obligations.
Community Discussion
No community discussion yet for this question.