An outsource service provider must handle sensitive customer information. Which of the following
is MOST important for an information security manager to know?

A.
Security in storage and transmission of sensitive data

B.
Provider’s level of compliance with industry standards

C.
Security technologies in place at the facility

D.
Results of the latest independent security review

Explanation:

Mow the outsourcer protects the storage and transmission of sensitive information will allow an
information security manager to understand how sensitive data will be protected. Choice B is an
important but secondary consideration. Choice C is incorrect because security technologies are
not the only components to protect the sensitive customer information. Choice D is incorrect
because an independent security review may not include analysis on how sensitive customer
information would be protected.