Objective 5.3: Explain the processes associated with third-party risk assessment and management
Security+ SY0-701 practice question
A company is negotiating a contract with a cloud payroll provider. The CISO insists that the company must be allowed to send its own assessors to examine the provider's security controls once a year and after any security incident that affects the company's data. Which contract provision addresses this requirement?
- Right-to-audit clause(Correct)
Correct. A right-to-audit clause is the provision that lets the company send its own assessors to examine the provider's controls, annually and after incidents.
- Service-level agreement (SLA)
An SLA defines measurable service commitments, such as uptime, response times, and penalties when they are missed. It does not grant the customer the right to inspect the provider's controls.
- Non-disclosure agreement (NDA)
An NDA obliges the parties to keep shared information confidential. It might cover what assessors learn, but it does not create the right to perform the assessment.
- Memorandum of understanding (MOU)
An MOU records a mutual intent or understanding between parties and is usually not legally binding, so it is a poor tool for guaranteeing audit rights.
Explanation
A right-to-audit clause gives the customer the contractual right to assess a vendor's controls directly or through a third party it chooses, often on a schedule and after specific triggers such as a breach. Without it, the customer usually has to rely on whatever reports the vendor chooses to share, such as its own internal audit results or independent assessments.