An organization is preparing to engage a third-party managed service provider (MSP) to handle sensitive customer data archiving and off-site backup management. As part of the enterprise third-party risk management (TPRM) governance program, the security team must implement controls that verify operational effectiveness over time and guarantee access for compliance verification. Which TWO of the following requirements should be included in the vendor oversight framework?
- Incorporate a Right-to-Audit clause in the contract to ensure the enterprise or designated third parties can evaluate the vendor's security controlsAnswer
- BRequire the vendor to execute an Interconnection Security Agreement (ISA) to establish physical security boundaries at the vendor's backup site
- Require continuous receipt of independent SOC 2 Type II audit reports to verify the operational effectiveness of vendor controls over an extended evaluation periodAnswer
- DDeploy network-level inline intrusion prevention sensors within the vendor's internal database network to enforce data access policies
- ESubstitute annual vendor risk assessments with bi-weekly external vulnerability port scans against the vendor's public IP infrastructure
Answer
The organization should incorporate a contractual Right-to-Audit clause and require continuous receipt of independent SOC 2 Type II audit reports to ensure third-party risk oversight.
Effective third-party risk oversight requires both legal authority to inspect vendor operations (via Right-to-Audit clauses) and independent verification of long-term operational control effectiveness (via SOC 2 Type II audit reports).
Step-by-Step Solution
Key Concept
Third-Party Governance and Vendor Oversight Controls