Identifying and Addressing Risk of Data Compromise in Cloud Services
Question
A business unit within an enterprise has directly contracted with a cloud service provider to process sensitive customer information.
The CIO later identifies a serious risk of potential data compromise due to the vendor's insufficient segregation of environments and lack of strong access controls.
The FIRST course of action should be to:
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.B.
The FIRST course of action that should be taken when a serious risk of potential data compromise is identified due to a vendor's insufficient segregation of environments and lack of strong access controls is to discuss the risk with the vendor to determine mitigation actions. Therefore, option C is the correct answer.
Explanation: Option A, immediately suspending sending of data to the cloud service provider, may be a valid option in certain scenarios, but it could also result in significant disruptions to the business process. This action should only be taken after a thorough assessment of the risk, and after the risk has been appropriately mitigated.
Option B, notifying internal audit of the risk, is a good practice but should not be the first action taken, as it does not address the immediate risk of data compromise.
Option D, informing the business process owner of the risk, is important, but it should not be the first action taken. The CIO should first work with the vendor to determine mitigation actions, and then inform the business process owner of the actions that will be taken to address the risk.
Therefore, the FIRST course of action should be to discuss the risk with the vendor to determine mitigation actions. This will allow for a timely resolution of the risk while minimizing disruptions to the business process. The CIO should work closely with the vendor to ensure that appropriate measures are taken to address the risk, such as implementing stronger access controls or improving the segregation of environments. Once the risk has been appropriately mitigated, the CIO should inform the business process owner of the actions taken to address the risk.
