Watch this video on YouTube
An organization has outsourced its billing function to an external service provider. Who should own the risk of customer data leakage caused by the service provider?