An enterprise has decided to procure security services from a third-party vendor to support its information security program. Which of the following is MOST important to include in the vendor…

The maturity of the vendor's internal control environment is important for their own security, but alignment of objectives is more critical for the strategic success of the partnership.

Feedback from previous clients is useful for due diligence but does not guarantee alignment with the specific enterprise's security goals.

Alignment of the vendor's business objectives with the enterprise's security goals ensures that the third-party's priorities and operational strategies support, rather than conflict with, the organization's security posture and risk appetite. This synergy is crucial for a successful long-term partnership that effectively enhances the enterprise's information security program and addresses its specific needs.

Penetration testing against the vendor's network is a technical security assessment, not a primary criterion for overall strategic vendor selection and partnership alignment.