An organization's IT team has proposed the adoption of cloud computing as a cost-saving measure for the business. Which of the following should be of GREATEST concern to the risk practitioner?

Performing thorough due diligence on a cloud vendor is the greatest concern because it involves comprehensively assessing the vendor's security posture, compliance, operational practices, and financial stability, which are all critical for understanding and managing the inherent risks introduced by relying on a third-party service.

While business units introducing SaaS without IT approval (shadow IT) is a significant risk, it is often a post-adoption challenge; the failure to vet the primary vendor at the proposal stage is a more fundamental and immediate concern for the initial adoption.

Outsourcing IaaS maintenance is an inherent aspect of the IaaS model and, while it shifts responsibilities, it is not the greatest concern if proper due diligence and contractual agreements are in place.

Unclear architecture responsibilities, though problematic, can be addressed through governance and design processes during implementation, whereas a lack of initial vendor vetting creates pervasive and potentially unmanageable risks from the outset.