The most important objective of information security controls is to provide measurable risk reduction.
Information security controls are the policies, procedures, techniques, or technologies that are implemented to protect the confidentiality, integrity, and availability of information assets. The main purpose of information security controls is to reduce the risk of unauthorized access, use, disclosure, modification, or destruction of information assets, and to ensure that the information assets support the enterprise's objectives and performance. Information security controls should be measurable, meaning that they should have clear and quantifiable criteria for evaluating their effectiveness and efficiency in reducing the risk exposure to an acceptable level. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1, page 1151

The vendor must host data in a specific geographic location to ensure that the data is protected by the applicable data protection laws of the EU or the country where the data originates. This is especially important for SaaS customers who transfer personal data from the EU to third countries, as they need to comply with the GDPR and the new Standard Contractual Clauses (SCCs) that regulate such transfers. The vendor must also provide adequate security measures and guarantees to protect the data from unauthorized access, disclosure, or loss. References = Risk and Information Systems Control Study Manual, Chapter 5: IT Risk Mitigation, Section 5.3: IT Risk Mitigation Strategies and Approaches, Page 253; Data Protection - New EU Standard Contractual Clauses - Bodle Law.

The most appropriate action for the risk manager to take after undertaking a risk assessment of a production system is to inform the process owner of the concerns and propose measures to reduce them, as the process owner has the authority and responsibility to manage the production system and its associated risks and controls, and to decide on the optimal risk response. Recommending a program that minimizes the concerns of that production system, informing the IT manager of the concerns and proposing measures to reduce them, and informing the development team of the concerns and together formulating risk reduction measures are not the most appropriate actions, as they may not involve the process owner, who is the key stakeholder and decision maker for the production system and its risks. References = CRISC Review Manual, 7th Edition, page 101.

Section: Volume D