Question

A SaaS provider's enterprise customers increasingly demand independent assurance that the provider's controls over customer data are designed and operating effectively over a period of time. The provider's internal audit team already performs quarterly control reviews, but customers state that internal reports are insufficient for their own vendor risk programs. Which assessment approach BEST satisfies the customers' requirement?

Accepted Answer

Engage a qualified independent audit firm to produce a SOC 2 Type II report covering the relevant Trust Services Criteria

Answer

Expand the internal audit schedule to monthly and publish the internal findings to customers

Answer

Commission an external penetration test and share the executive summary with customers

Answer

Complete a self-assessment questionnaire and have the CISO formally attest to its accuracy