Certified in Risk and Information Systems Control (CRISC) — Question 681

A contract associated with a cloud service provider MUST include:

Answer options

• A. a business recovery plan
• B. ownership of responsibilities
• C. provision for source code escrow
• D. the provider's financial statements

Correct answer: B

Explanation

The correct answer is B, as it is essential to clearly define the ownership of responsibilities between the cloud service provider and the client to avoid any misunderstandings. Options A, C, and D, while potentially important in certain contexts, are not universally mandatory in all contracts with cloud service providers.