The B/D seeks the right to audit where feasible, agreeing in advance with the provider how far it may audit and verify the controls in the SLA, with the pre-engagement controls audit as the benchmark for ongoing audits, and how compliance evidence such as audit logs, activity reports and system configurations is collected, stored and shared. It engages independent auditors regularly, including for penetration testing and vulnerability assessment, with rationale and evidence to substantiate compliance judgements; where auditing the provider is not feasible it obtains third-party audit reports that meet industry standards and its requirements. The third-party auditor is disclosed or selected jointly in advance where possible, the breadth and depth of audit are aligned between the parties, and audit reports are obtained periodically from the provider for analysis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.