A company outsources card payment processing. It wants contractual assurance that it can inspect the vendor's security controls when needed, and it also wants formal annual evidence that the vendor remains compliant with the applicable standard. Which combination meets both needs?
Select an answer to reveal the explanation.
Short Explanation
You want two things here: the key to the vendor's door whenever you need it, and a signed report card every year. The right-to-audit clause is the key; the compliance attestation is the report card. The trap is the SLO and dashboard, which tell you about uptime, not security compliance.
Full Explanation
Vendor monitoring combines contractual rights with ongoing evidence. A right-to-audit clause grants the customer, or an independent auditor it appoints, the contractual authority to examine the vendor's controls, records, and facilities, which supports inspection when concerns arise or as part of periodic reviews. Compliance attestation is a formal statement, often backed by an independent assessment, that the vendor meets a stated standard over a defined period; requiring it annually gives the customer recurring evidence without performing a full audit each year. Together they satisfy both the inspection need and the recurring evidence need. A non-disclosure agreement protects confidential information and a vendor registry inventories third parties; neither grants inspection rights nor supplies compliance evidence. A service-level objective and an uptime dashboard track performance and availability, which matters operationally but says nothing about whether security controls meet a payment standard. A memorandum of understanding is generally non-binding and an expression of interest is a pre-selection signal of willingness to bid, so neither provides contractual audit authority or ongoing assurance. Exam caveat: attestations cover a defined scope and period, so the customer must confirm the outsourced service is actually in scope. Operational check: verify the contract contains the audit clause, calendar each attestation's due date, and review its scope statement on receipt.