Question

A manufacturing company signs a contract with a large retail customer that includes strict information security clauses requiring encryption of all customer data and 24-hour breach notification. The company stores this data with a third-party cloud provider whose standard service agreement offers only 72-hour breach notification and does not commit to the required encryption controls. What should the information security manager do FIRST?

Accepted Answer

Perform a gap analysis comparing the customer contractual obligations against the cloud provider's contractual commitments

Answer

Accept the cloud provider's terms and document the gap as a residual risk in the risk register

Answer

Immediately terminate the cloud provider contract and migrate data to an in-house data center

Answer

Notify the retail customer that the 24-hour breach notification requirement cannot be met