Câu 52: CGEIT: Certified in the Governance of Enterprise IT

An enterprise is planning to outsource data processing for personally identifiable information (PII). When is the MOST appropriate time to define the requirements for security and privacy of information?

1. A. During the initial vendor selection process
2. B. After an assessment of the current information architecture — đáp án hiện tại
3. C. When issuing requests for proposals (RFPs)
4. D. When developing service level agreements (SLAs)