Which of the following is MOST important to consider when outsourcing a customer service function that processes sensitive data?

The correct answer is C. The ability of the vendor to adequately protect information. The paramount concern when outsourcing any function involving sensitive data is whether the vendor has the capability and controls to actually protect that data. An NDA (A) is a legal instrument that creates liability after a breach but does not prevent one - it is only as…

Submitted by noor.lb· Apr 18, 2026Information Security Risk Management

Question

Options

AThe ability to obtain signed nondisclosure agreements (NDAs)
BThe vendor's data retention and disposal policy
CThe ability of the vendor to adequately protect information
DThe contractual penalties related to dissemination of information

How the community answered

(55 responses)

A
5% (3)
B
9% (5)
C
65% (36)
D
20% (11)

Explanation

The paramount concern when outsourcing any function involving sensitive data is whether the vendor has the capability and controls to actually protect that data. An NDA (A) is a legal instrument that creates liability after a breach but does not prevent one - it is only as useful as the vendor's underlying security posture. Data retention and disposal policies (B) are an important subset of data protection capability but represent only one aspect of the overall security program. Contractual penalties (D) are compensatory mechanisms activated after harm has occurred; they deter misconduct but do not protect data. If the vendor lacks adequate security capability, none of the legal or policy mechanisms in options A, B, or D can substitute for that foundational gap.

Topics

#Outsourcing Security#Third-Party Risk Management#Data Protection#Vendor Due Diligence

Community Discussion

No community discussion yet for this question.

Full CISM Practice