Question

A financial services firm is being audited against its own controls, many of which now depend on a SaaS provider that hosts customer transaction data. The firm's auditor requests to physically inspect the provider's data centers and run vulnerability scans against the provider's shared infrastructure. The provider refuses both requests, citing multitenancy and its own security policies. What is the MOST appropriate way for the firm to satisfy the auditor's need for assurance over the outsourced controls?

Accepted Answer

Obtain and review the provider's independent third-party attestation (such as a SOC 2 Type II report) and map its relevant controls to the firm's control objectives

Answer

Escalate to the provider's executives and invoke the contract's audit clause to force an on-site inspection, since the firm remains accountable for its data

Answer

Accept the residual risk and document that the outsourced controls cannot be audited in a cloud environment

Answer

Require the provider to migrate the firm's data to a single-tenant environment so that direct scanning and inspection become feasible