Which statement about compliance responsibilities and ownership of accountability is correct?

Question

Options

• AOrganizations may be able to transfer their accountability for compliance with various regulatory
• BOrganizations may be able to transfer their responsibility for compliance with various regulatory
• COrganizations may transfer their responsibility and accountability for compliance with various
• DOrganizations are not able to transfer their responsibility nor accountability for compliance with

• A
  3% (1)
• B
  3% (1)
• C
  9% (3)
• D
  85% (29)

Explanation

A foundational principle in compliance and regulatory law is that organizations cannot transfer either their responsibility or their accountability to a third party, including cloud service providers. While they may delegate or outsource specific tasks (e.g., hiring a CSP to store data), the legal and regulatory obligation remains with the original organization. Regulators hold the data controller or responsible entity liable regardless of which vendor performs the actual work. This is why even when using a CSP, the client organization must ensure the CSP meets the required compliance standards - because the client organization is still on the hook.

No community discussion yet for this question.