A healthcare organization is finalizing a contract with a cloud service provider that will store and process electronic protected health information (ePHI). The security team wants to ensure they can verify the vendor's security controls and compliance status throughout the contract period. Which contract provision should the organization prioritize to maintain ongoing visibility into the vendor's security posture?