When outsourcing data processing overseas, which concern should the information security manager raise FIRST?

1. AThe vendor's choice of programming language
2. BLegal and regulatory restrictions on data transfer
3. CThe time zone difference only
4. DThe vendor's office decoration