Certified Information Systems Security Professional (CISSP) — Question 331

An organization outgrew its internal data center and is evaluating third-party hosting facilities. In this evaluation, which of the following is a PRIMARY factor for selection?

Answer options

• A. Facility provides an acceptable level of risk
• B. Facility provides disaster recovery (DR) services
• C. Facility has physical access protection measures
• D. Facility provides the most cost-effective solution

Correct answer: A

Explanation

The primary factor in selecting a third-party hosting facility is ensuring an acceptable level of risk, as this directly impacts the organization's security and compliance. While disaster recovery services, physical access protection, and cost-effectiveness are important considerations, they become secondary to the overall risk management strategy of the organization.