Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Enterprise Resource Management

An Indian company hosts its ERP on a cloud provider, and the ERP holds employees' and customers' personal data. A breach exposes this data because default administrator passwords were never changed. Which statement best reflects the legal and risk position?

The company may be answerable for failing to maintain reasonable security practices. Outsourcing hosting does not shift its duty, and unchanged default passwords are an internal control lapse. A centralised ERP concentrates sensitive data, so one weakness can expose everything.

  1. ALiability shifts entirely to the cloud provider because the data is hosted outside the company's premises
  2. BThe company has no responsibility since ERP vendors are always liable for security
  3. CThe company, as the entity handling the data, may be answerable for failing to keep reasonable security practices, since a centralised ERP concentrates riskCorrect
  4. DNo legal consequence arises unless the data is financial in nature

Explanation

Under Indian cyber and data protection law, the organisation controlling or handling personal data is expected to maintain reasonable security safeguards; outsourcing hosting does not remove this. Unchanged default passwords show a lapse in its own controls. Centralised ERP data makes such lapses more damaging.

Did you get it right without looking?

One question tells you little. A timed set on Enterprise Resource Management shows your real accuracy, how long you take and where you lose marks.

Practise Enterprise Resource ManagementFree diagnostic mock

More Enterprise Resource Management questions