An organization is considering using a third party to host sensitive archived data. Which of the following is MOST important to verify before entering into the relationship?

The correct answer is C. The vendor's controls are in line with the organization's security standards.. Before entrusting a third party with sensitive archived data, the most important consideration is whether the vendor’s controls align with the organization’s security standards and risk tolerance. This ensures the data will be protected to the required level; audits, key manageme

Submitted by daniela_cl· Apr 18, 2026Information Security Risk Management

Question

Options

AThe encryption keys are not provided to the vendor.
BIndependent audits of the vendor's operations are regularly conducted.
CThe vendor's controls are in line with the organization's security standards.
DThe vendor's data centers are in the same geographic region.

How the community answered

(22 responses)

A
5% (1)
B
23% (5)
C
64% (14)
D
9% (2)

Explanation

Before entrusting a third party with sensitive archived data, the most important consideration is whether the vendor’s controls align with the organization’s security standards and risk tolerance. This ensures the data will be protected to the required level; audits, key management, and location are important but secondary to overall control alignment.

Topics

#Third-party risk management#Vendor assessment#Due diligence#Security controls alignment

Community Discussion

No community discussion yet for this question.

Full CISM Practice