Which of the following is the MOST significant risk associated with using cloud computing for...

In cloud-based disaster recovery, CRISC emphasizes that the most impactful strategic risk is vendor lock-in and dependency. When disaster recovery capabilities rely on a single cloud provider, organizations become fully dependent on that provider’s technology, APIs, and platform architecture. This dependency makes it difficult and costly to migrate to another provider, limits flexibility in recovery options, and increases exposure if the provider experiences outages or changes service terms. While availability issues, CASB usage, and incident management gaps are important, they do not present the same level of strategic long-term operational and resilience impact as vendor lock-in.