nerdexam
Isaca

CRISC · Question #56

An organization is planning to move its application infrastructure from on-premises to the cloud. Which of the following is the BEST course of the actin to address the risk associated with data…

The correct answer is B. Ensure the language in the contract explicitly states who is accountable for each step of the data. When moving to the cloud, the best action to address data transfer risks upon vendor termination is to ensure the contract explicitly defines accountability for each step of data handling and repatriation.

Submitted by yousef_jo· Apr 18, 2026Risk Response and Reporting

Question

An organization is planning to move its application infrastructure from on-premises to the cloud. Which of the following is the BEST course of the actin to address the risk associated with data transfer if the relationship is terminated with the vendor?

Options

  • AMeet with the business leaders to ensure the classification of their transferred data is in place
  • BEnsure the language in the contract explicitly states who is accountable for each step of the data
  • CCollect requirements for the environment to ensure the infrastructure as a service (IaaS) is
  • DWork closely with the information security officer to ensure the company has the proper security

How the community answered

(21 responses)
  • A
    29% (6)
  • B
    57% (12)
  • C
    10% (2)
  • D
    5% (1)

Why each option

When moving to the cloud, the best action to address data transfer risks upon vendor termination is to ensure the contract explicitly defines accountability for each step of data handling and repatriation.

AMeet with the business leaders to ensure the classification of their transferred data is in place

Data classification is a prerequisite for proper data handling but does not, by itself, guarantee secure or effective data transfer back to the organization upon vendor termination.

BEnsure the language in the contract explicitly states who is accountable for each step of the dataCorrect

Explicitly stating accountability in the contract for data transfer and repatriation upon termination legally binds the vendor to specific actions, ensuring a clear and governed process for data return or deletion. This contractual agreement is crucial for managing the complex process of data exit, minimizing data loss, and maintaining compliance, directly addressing the risk of vendor lock-in or data accessibility issues.

CCollect requirements for the environment to ensure the infrastructure as a service (IaaS) is

Collecting requirements for the IaaS environment focuses on the operational phase within the cloud and does not directly address the specific risk of data transfer during contract termination.

DWork closely with the information security officer to ensure the company has the proper security

Working with the information security officer ensures proper security during the active relationship, but it does not specifically mitigate the unique challenges and risks associated with data repatriation upon contract termination.

Concept tested: Cloud exit strategy / Vendor contract management

Source: https://www.enisa.europa.eu/publications/cloud-computing-information-assurance/at_download/fullReport

Topics

#Cloud Risk Management#Vendor Risk Management#Contract Management#Cloud Exit Strategy

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice