Question

An organization is finalizing a contract with a SaaS provider that will process sensitive customer data. During review, the information security manager notices the agreement contains no provision allowing the organization to validate the vendor's ongoing security posture. Which contractual element is MOST important to add before signing?

Accepted Answer

A right-to-audit clause permitting security assessments or acceptance of independent attestation reports

Answer

A clause requiring the vendor to carry cyber insurance covering data breaches

Answer

A service-level agreement defining maximum acceptable system downtime

Answer

A clause obligating the vendor to encrypt data in transit using TLS