An organization outsources its data center operations. What is the BEST way to ensure the service provider's controls are effective?
Trap 1: Rely on the provider's internal audit reports
Relying solely on the provider's internal audit may lack independence.
Trap 2: Monitor service level agreements only
Monitoring SLAs only focuses on performance, not control effectiveness.
Trap 3: Require the provider to implement all organizational controls
Requiring the provider to implement all organizational controls may be impractical and expensive.
- A
Conduct periodic third-party audits
Independent third-party audits provide objective verification of controls.
- B
Rely on the provider's internal audit reports
Why wrong: Relying solely on the provider's internal audit may lack independence.
- C
Monitor service level agreements only
Why wrong: Monitoring SLAs only focuses on performance, not control effectiveness.
- D
Require the provider to implement all organizational controls
Why wrong: Requiring the provider to implement all organizational controls may be impractical and expensive.