Exam CRISC topic 1 question 1626 discussion

B. Contractual requirements: Establishing clear contractual terms with the service provider is crucial. Contracts should specify access controls, audit rights, and compliance with data protection requirements. This ensures that administrators have only the access they need and that any unauthorized access is prohibited by the agreement.

To best protect against a recurrence of a service provider's administrator accessing sensitive information without approval in an Infrastructure as a Service (IaaS) model, the most effective measure would be: C. Data encryption. Encrypting data is a direct way to protect sensitive information from unauthorized access. Even if a service provider's administrator gains access to the data, encryption ensures that the content remains unreadable and secure without the appropriate decryption keys. This measure protects the data at rest as well as in transit, providing a robust defense against unauthorized access, regardless of the internal controls or policies of the service provider.