CISM · Question #463
Which of the following is the MOST effective way to verify a service provider is maintaining adequate controls to protect customer data?
The correct answer is C. Review annual independent controls reports of the service provider. Annual independent controls reports-such as SOC 2 Type II or ISO 27001 audit reports-provide objective, comprehensive, third-party verification that a service provider's controls are designed and operating effectively over time. SLAs (A) are contractual commitments but do not…
Question
Which of the following is the MOST effective way to verify a service provider is maintaining adequate controls to protect customer data?
Options
- AReview third-party service level agreements (SLAs).
- BPerform a penetration test against the service provider.
- CReview annual independent controls reports of the service provider.
- DProvide standards by which to protect the data to the service provider.
How the community answered
(31 responses)- A10% (3)
- B6% (2)
- C81% (25)
- D3% (1)
Explanation
Annual independent controls reports-such as SOC 2 Type II or ISO 27001 audit reports-provide objective, comprehensive, third-party verification that a service provider's controls are designed and operating effectively over time. SLAs (A) are contractual commitments but do not verify actual control performance. A penetration test (B) is narrow in scope and only reveals technical vulnerabilities at a point in time. Providing standards (D) sets expectations but does not confirm compliance. Independent audit reports are the gold standard for third-party assurance.
Topics
Community Discussion
No community discussion yet for this question.