ISOISO 27001Risk Assessment and TreatmentEASYFree question
A manufacturer outsources its payroll processing to a third party to reduce its own handling of sensitive employee data. Which combination most accurately characterizes this in risk-treatment terms?
- A.Modification only, because a control was added
- B.Pure avoidance, because the company no longer processes payroll
- C.Pure retention, because outsourcing changes nothing
- D.Sharing the risk with the provider, while retaining accountability and residual third-party risk that must itself be treated
Why D is correct
Outsourcing shares part of the operational risk with the provider, but the organization retains accountability and now faces third-party/supplier risk that must be assessed and treated. Accountability for the data cannot be outsourced.
Know someone studying for ISO 27001? Send them this one.