Before engaging outsourced providers, an information security manager should ensure that the
organization’s data classification requirements:
A.
are compatible with the provider’s own classification.
B.
are communicated to the provider.
C.
exceed those of the outsourcer.
D.
are stated in the contract.
Explanation:
The most effective mechanism to ensure that the organization’s security standards are met by a
third party, would be a legal agreement. Choices A. B and C are acceptable options, but not as
comprehensive or as binding as a legal contract.