ISC2 Governance, Risk and Compliance (CGRC) Practice Question

When data containing personally identifiable or otherwise sensitive information is moved to a cloud service, the most immediate concern for security and privacy is how that provider will protect the data. This includes verifying that strong encryption is applied in transit and at rest, appropriate access controls are enforced, and that data is stored in jurisdictions that meet the organization's regulatory obligations. Although cost, user productivity, and future feature sets are relevant to project planning, they do not speak directly to the potential impact on confidentiality, integrity, and compliance, which is the primary focus when analysing a proposed change's effect on the security and privacy posture.