What it means
The customer may delegate tasks, infrastructure, or operations, but it retains responsibility for understanding risk, setting requirements, making acceptance decisions, and coordinating incidents and continuity.
Why it matters
Outsourcing can create visibility gaps, concentration risk, unclear authority, and operational dependencies that are difficult to unwind during an incident or provider failure.
Practical focus
- Define shared roles, escalation, evidence, and decision authority
- Monitor service, control, incident, and dependency performance
- Integrate providers into response and continuity exercises
- Maintain transition, data return, and exit options
Common mistakes
- Assuming certification replaces customer oversight
- Treating provider dashboards as complete evidence
- Failing to test cross-organizational incident processes
- Allowing undocumented subcontractor changes
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: