A.Conduct an unannounced vulnerability assessment of vendor's IT systems.

B.Obtain evidence of the vendor's control self-assessment (CSA).

C.Periodically review the service level agreement (SLA) with the vendor.

D.Conduct periodic on-site assessments using agreed-upon criteria.

A.IT investments are implemented and monitored following a system development life cycle (SDLC)

B.The IT Investment budget is significantly below industry benchmarks

C.IT investments are mapped to specific business objectives

D.Key performance indicators (KPIs) are defined for each business requiring IT Investment

A.Verification of hash totals

B.Use of pass cards to gain access to physical facilities

C.Backup procedures

D.Programmed edit checks for data entry

A.No official charier for the information security management system

B.No dedicated security officer

C.No periodic assessments to identify threats and vulnerabilities

D.No employee awareness training and education program

A.channel access through authentication.

B.block authorized users from unauthorized activities.

C.channel access only through the public-facing firewall.

D.communicate via Transport Layer Security (TLS),