Company ABC is planning to outsource its Customer Relationship Management system (CRM)
and marketing / leads management to Company XYZ.
Which of the following is the MOST important to be considered before going ahead with the
service?

A.
Internal auditors have approved the outsourcing arrangement.

B.
Penetration testing can be performed on the externally facing web system.

C.
Ensure there are security controls within the contract and the right to audit.

D.
A physical site audit is performed on Company XYZ’s management / operation.