Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Orrin Health uses a cloud supplier to host patient records. After a breach at the supplier, regulators fine Orrin. Orrin's board claims responsibility lay entirely with the supplier under the outsourcing contract. Which view is most consistent with sound cyber governance?

The board is wrong. Outsourcing hosting does not transfer accountability for patient data, which stays with Orrin. Sound governance requires supplier due diligence, contractual security obligations and ongoing monitoring, so the regulatory penalty on Orrin is consistent with retained responsibility.

  1. AThe board is correct, because contractual outsourcing transfers all accountability to the supplier
  2. BThe board is incorrect, because it remains accountable for protecting patient data and should have performed supplier due diligence, contractual security requirements and ongoing monitoringCorrect
  3. CThe board is correct only if the supplier is larger than Orrin
  4. DThe board is incorrect, because cloud suppliers are never permitted to hold personal data

Explanation

Operational tasks can be outsourced but accountability for data protection stays with the data controller's board. Governance therefore requires due diligence, contract terms, audit rights and monitoring. Supplier size is irrelevant, and cloud hosting of personal data is permitted under suitable safeguards.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions