HR Negligent?

Looking for comments and opinions please.

I'm the head of IT at my company. Named security officer in our policies and on our cyber insurance policy.

HR dept. consists of two people. All HR data resides not in our 365 tenant, but instead a cloud storage app (think Dropbox).

I have no visibility to this. I know it exists, I know HR data is in it. I have asked to ensure MFA is turned on for users, is able to …

app cloud cloud storage comments cyber cyber insurance cyber insurance policy cybersecurity data dropbox head insurance insurance policy mfa officer opinions people policies policy security security officer storage visibility