An organization that outsourced its payroll processing performed an independent assessment of the security
controls of the third party, per policy requirements. Which of the following is the MOST useful requirement to
include in the contract?

A.
Right to audit

B.
Nondisclosure agreement

C.
Proper firewall implementation

D.
Dedicated security manager for monitoring compliance

Explanation:

Right to audit would be the most useful requirement since this would provide the company the ability to perform a security audit/assessment whenever there is a business need to examine whether the controls are working effectively at the third party. Options B, C and D are important requirements and can be examined during the audit. A dedicated security manager would be a costly solution and not always feasible for most situations.