ExamGecko
Question list
Search
Search

Question 336 - CISM discussion

Report
Export

Of the following, who is accountable for data loss in the event of an information security incident at a third-party provider?

A.
The information security manager
Answers
A.
The information security manager
B.
The service provider that hosts the data
Answers
B.
The service provider that hosts the data
C.
The incident response team
Answers
C.
The incident response team
D.
The business data owner
Answers
D.
The business data owner
Suggested answer: D

Explanation:

The business data owner is accountable for data loss in the event of an information security incident at a third-party provider because they are ultimately responsible for the protection and use of their data, regardless of where it is stored or processed. The information security manager is not accountable for data loss at a third-party provider, but rather responsible for implementing and enforcing the security policies and standards that govern the relationship with the provider. The service provider that hosts the data is not accountable for data loss at their site, but rather liable for any breach of contract or service level agreement that may result from such an incident. The incident response team is not accountable for data loss at a third-party provider, but rather responsible for responding to and managing the incident according to the incident response plan.

Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-1/data-ownership-and-custodianship-in-the-cloud https://www.isaca.org/resources/isaca-journal/issues/2018/volume-3/incident-response-lessons-learned

asked 01/10/2024
Steve Daniels
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first