A financial services firm is finalizing a contract with a cloud-based payroll processor that will handle employee PII and payment data. The security team wants assurance that they can independently verify the vendor's control environment throughout the multi-year engagement, rather than relying solely on the vendor's marketing claims or a one-time attestation provided during onboarding. Which contractual provision BEST achieves this objective?