Exam CCAK topic 1 question 1 discussion

C is the correct answer. If the change/s introduces additional risk, - the risk appetite and tolerance can determine if the organization is willing to take or tolerate the introduced risk.

Correct answer is C

B. Contractual requirements

Risk Appetite, risk exception policy and board oversight of an organization does not change due to a change in a service provider and the question does not refer to changes in risk methodology of the organization. Hence, considering same, the changes will only be in the contractual agreements of the new service provider. Thereby referring to ats20 response below, the number of controls will either increase or decrease due to changes in contractual requirements with the new SaaS provider.

The contractual requirements are the MOST likely to influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization’s SaaS vendor. Contractual requirements define the terms and conditions of the agreement between the organization and the SaaS vendor, including the security and compliance requirements. Therefore, any changes to the contractual requirements can impact the controls required to remediate the risk arising from changes to an organization’s SaaS vendor.

C, the reason being Risk Appetite can influence either expansion/ reduction.