An organization learns that a third party has outsourced critical functions to another external provider. Which of the following is the information security manager's MOST important course of action?

Engaging an independent audit of the sub-provider might be a later step, but the most important initial action is to understand the contractual obligations and existing controls.

An external audit of the contracted third party would address their controls, but it doesn't directly address the new risk introduced by their sub-contracting of critical functions.

Recommending canceling the contract is an extreme measure without first understanding the implications and contractual obligations of the sub-contracting.

Evaluating the third party's agreements with its external provider is crucial because it ensures that the original security and compliance requirements stipulated in the primary contract are flowed down and appropriately addressed by the sub-contractor. This due diligence ensures the organization's risks are managed even through multi-tiered outsourcing.