CISSP · Question #878
A large international organization that collects information from its consumers has contracted with a Software as a Service (SaaS) cloud provider to process this data. The SaaS cloud provider uses add
The correct answer is D. The agreement between the two parties is vague and does not detail how the data can be used.. The large org is the data controller and CSP is its data processor. But data processors do not decide how to process data. Data Controller, the large org controls how data is to be processed.
Question
A large international organization that collects information from its consumers has contracted with a Software as a Service (SaaS) cloud provider to process this data. The SaaS cloud provider uses additional data processing to demonstrate other capabilities it wishes to offer to the data owner. This vendor believes additional data processing activity is allowed since they are not disclosing to other organizations. Which of the following BEST supports this rationale?
Options
- AThe data was encrypted at all times and only a few cloud provider employees had access.
- BAs the data owner, the cloud provider has the authority to direct how the data will be processed.
- CAs the data processor, the cloud provider has the authority to direct how the data will be
- DThe agreement between the two parties is vague and does not detail how the data can be used.
How the community answered
(40 responses)- A15% (6)
- B28% (11)
- C8% (3)
- D50% (20)
Explanation
The large org is the data controller and CSP is its data processor. But data processors do not decide how to process data. Data Controller, the large org controls how data is to be processed.
Topics
Community Discussion
No community discussion yet for this question.