The Chief Executive Officer (CEO) of a corporation decided to move all email to a cloud computing
environment. The Chief Information Security Officer (CISO) was told to research the risk involved
in this environment.
Which of the following measures should be implemented to minimize the risk of hosting email in
the cloud?

A.
Remind users that all emails with sensitive information need be encrypted and physically
inspect the cloud computing.

B.
Ensure logins are over an encrypted channel and obtain an NDA and an SLA from the cloud
provider.

C.
Ensure logins are over an encrypted channel and remind users to encrypt all emails that
contain sensitive information.

D.
Obtain an NDA from the cloud provider and remind users that all emails with sensitive
information need be encrypted.