Data collected by a third-party vendor and provided back to the organization may not be protected according to the organization’s privacy notice. Which of the following is the BEST way to address this concern?

The organization’s privacy notice obligations should be flowed-down to the third party through contractual clauses. The most direct, enforceable way to verify that the vendor is honoring those obligations is to test the vendor’s performance against the contract’s privacy and security requirements and demand remediation where gaps are found.

A. Reviewing the privacy policy does not confirm the third-party’s actual protections or adherence to contract terms.
B. Independent assurance is valuable but is a secondary control; without contractual obligations, assurance lacks an explicit benchmark.
C. Reassessing internal security requirements does not address whether the vendor is meeting externally contracted privacy commitments.

1. ISACA CDPSE Review Manual, 1st ed., 2021, Ch. 2, “Third-Party & Vendor Management,” pp. 86-88.

2. ISACA Privacy Principles and Program Management Guide, 2017, §6.2 “Vendor Oversight,” p. 144.

3. NIST Privacy Framework v1.0, ID.GV-3, Jan 2020.