Exin CDFOM Exam - Topic 11 Question 3 Discussion

EPI's governance and risk management principles clearly state:

When a data center outsources maintenance, operational work can be outsourced, but risk cannot be transferred.

Risk may be shared, mitigated, or reduced through contractual arrangements, but ownership remains with the data center service provider.

The data center operator is still responsible for ensuring compliance, operational continuity, and safety---even if another party performs the maintenance tasks.

Therefore:

The service provider must remain involved in risk evaluation, risk treatment, and ongoing monitoring.

Oversight responsibilities cannot be delegated.

Options C and D are incorrect because outsourcing the activity does not outsource risk accountability.

Option B is irrelevant because risk responsibility does not depend on provider expertise.

Thus, A is correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Risk ownership remains with the organization even when maintenance is outsourced.

Outsourcing shares risk but does not transfer it.

The data center must maintain involvement in the risk management process.