A business unit wants to move a workload to a large public cloud provider. The provider's standard terms prohibit individual customer audits of its data centers. What is the BEST way for the information security manager to obtain assurance over the provider's controls?
Select an answer to reveal the explanation.
Short Explanation
You can't walk into a hyperscaler's data center with a clipboard, so you borrow someone else's eyes: independent auditors who already did. Reading those attestation reports against your own requirements is the grown-up move. Watch the trap of refusing outright; that's a business decision, and the business case may well be sound.
Full Explanation
Large providers serve many thousands of customers and cannot admit each one to their facilities, so they commission independent auditors and publish attestation reports and certifications instead. The security manager's job is to obtain those reports, check that their scope covers the services being used, compare the controls tested with the organization's requirements and note any exceptions and complementary customer controls. This gives credible, independent assurance without a site visit. Rejecting the provider treats a right-to-audit clause as an absolute requirement, when the real requirement is adequate assurance; the decision to use the service belongs to the business, informed by risk. Published security statements are marketing material written by the provider and are not independently verified, so attaching them to a contract adds little assurance. A questionnaire answered only by the provider is a self-assessment; it can supplement independent evidence but cannot replace it for a significant workload. Exam caveat: an attestation covers a defined period and scope, so gaps between reports and out-of-scope services still need attention. Operational check: confirm the report period is current, the in-scope services match the workload, and complementary customer controls are assigned to owners.