Question

A financial services firm outsources its customer data processing to a third-party cloud provider. The contract includes a service-level agreement (SLA) requiring 99.9% availability and specific data-breach notification timelines mandated by the firm's regulator. During a governance review, the risk manager notes that no internal party has been formally assigned to monitor the provider's adherence to these contractual and regulatory obligations. Which action should the risk manager recommend FIRST?

Accepted Answer

Assign a business owner within the firm to be accountable for monitoring the provider's compliance with the SLA and regulatory obligations

Answer

Transfer full accountability for the obligations to the cloud provider through a revised indemnification clause

Answer

Purchase cyber insurance to cover potential losses arising from provider non-compliance

Answer

Require the cloud provider to submit an annual independent audit report to the regulator directly