A transit authority must satisfy a federal grant condition that requires an independent security audit of fare-collection systems. Which approach best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Grant language that says independent audit means someone outside the build team grades the homework. A third-party auditor against the grant criteria fits. Self-attestation by the coder, blogs, or help-desk pep talks do not count as independence.
Full Explanation
Third-party security audits provide independent assurance against external criteria such as grant, regulatory, or industry requirements. Independence and competence matter: the assessor should not be the control owner who built the system under review. Self-attestation, marketing narratives, and informal interviews alone do not satisfy an independent audit obligation.