Outsourced payroll is omitted from entity scope because “it is not on our servers.” The city remains accountable for employee data protection. What correction is needed?
Select an answer to reveal the explanation.
Short Explanation
“Not our servers” is not the same as “not our problem.” If the city is still on the hook for employee data, the outsourced payroll service belongs in entity scope. Accountability follows the obligation, not the rack location.
Full Explanation
If the city remains accountable for employee data protection, the outsourced payroll service should be included as an in-scope entity even when it is not on municipal servers. “Not our servers” is not the same as “not our problem”; accountability follows the obligation, not the rack location. Excluding SaaS payroll solely for infrastructure externality creates false gaps in privacy and control coverage. Represent the service—and related vendor relationship as appropriate—so assessments and controls can attach. Keeping payroll out of scope permanently because SaaS vendors cannot be entities invents a false limitation. Scoping only on-prem print servers as a substitute control for payroll data is theater that ignores the real processing location. Moving payroll governance exclusively into CIS-TPRM exam topics and ignoring IRM entities dodges CIS-RC entity scoping while still leaving the obligation unmanaged in IRM. Exam caveat: scope follows accountability, including third-party-hosted services; deep TPRM product build is out of core CIS-RC, but entity awareness is not. Operational check for the city: add an entity for the outsourced payroll service with an accountable owner, map privacy-related controls or risks, and review evidence expectations with the vendor manager without pretending on-prem printers cover payroll data.