Question

An information security manager is establishing a security control baseline for a new application being deployed on a third-party PaaS provider. The provider publishes a SOC 2 Type II report and a shared responsibility matrix indicating it manages physical, network, and hypervisor controls. What should the manager do FIRST when tailoring the organization's control baseline for this application?

Accepted Answer

Identify which baseline controls are inherited from the provider and which remain the organization's responsibility

Answer

Adopt the provider's controls in full and remove the corresponding controls from the organization's baseline

Answer

Require the provider to implement the organization's complete internal control baseline

Answer

Schedule an independent penetration test of the provider's underlying infrastructure