Which of the following is held accountable for the risk to organizational systems and data that result from outsourcing Information Technology (IT) systems and services?

The acquiring organization is the entity that owns the mission, data, and risk tolerance, and therefore cannot transfer accountability to an external provider. Per NIST SP 800-37 and supply chain risk management guidance, outsourcing shifts operational responsibility but not risk accountability - the organization that acquires the service remains responsible for ensuring adequate security controls are in place and for accepting residual risk.

The service provider bears contractual and operational responsibility for delivering secure services, but legal and mission accountability for the risk to organizational assets remains with the acquiring organization, not the vendor.

The risk executive (function) is an organizational role that coordinates risk management activities and ensures consistent risk decisions, but it does not bear ultimate accountability for risks introduced by outsourcing - the organization as a whole does.

The IT manager oversees day-to-day technology operations and may manage vendor relationships, but accountability for organizational risk from outsourcing decisions rests at the organizational level, not with an individual IT manager.