Câu 91: IIA-CIA-PART3: Certified Internal Auditor - Part 3 Business Analysis and Information Technology

According to IIA guidance, which of the following would be the best first step to manage risk when a third party is overseeing the organization's network and data?

1. A. Creating a comprehensive reporting system for vendors to demonstrate their ongoing due diligence in network operations.
2. B. Drafting a strong contract that requires regular vendor control reports and a right-to-audit clause.
3. C. Applying administrative privileges to ensure right-to-access controls are appropriate.
4. D. Creating a standing cybersecurity committee to identify and manage risks related to data security. — đáp án hiện tại