which of the following situations is it appropriate for an IT service provider to make copies of a customer’s confidential data?