Certified Information Systems Auditor (CISA) — Question 1349

Which of the following is MOST important for an organization to consider when planning to outsource data storage to a third-party provider?

Answer options

• A. The cost of delivering the service
• B. The country in which the provider operates
• C. The classification levels of the stored data
• D. The skill set and experience of the provider

Correct answer: C

Explanation

The classification levels of the stored data are crucial because they determine the security and compliance requirements that must be met by the provider. While cost, location, and provider expertise are important, they are secondary to ensuring that the data is handled according to its classification to protect sensitive information.