Organizations that rely on third-party vendors for IT services must ensure secure and controlled communication, especially in areas where external connections are involved. External connections typically include:
* Cloud services (e.g., SaaS, PaaS, IaaS)
* Third-party APIs
* Remote access (VPNs, firewalls, network gateways)
* IoT devices and external sensors
These connections introduce cybersecurity risks, requiring continuous monitoring, vendor communication, and security controls.
* (A) Applications.
* Incorrect. While application security is important, it is typically managed internally. Vendor involvement is needed for software patches and updates, but communication is not as tightly monitored.
* (B) Technical infrastructure.
* Incorrect. This layer includes internal IT components like servers, databases, and networks, which are mostly managed in-house. Vendor involvement is required for hardware/software updates but not to the same extent as external connections.
* (C) External connections. #
* Correct. External connections require tightly controlled communication with vendors to prevent security breaches, unauthorized access, and data leaks.
* IIA GTAG "Auditing IT Governance" highlights third-party risk management as a key area for IT audits.
* IIA Standard 2110 requires organizations to establish governance structures for vendor and IT security management.
* (D) IT management.
* Incorrect. IT management focuses on internal oversight of IT policies and compliance, but does not necessarily require tightly controlled vendor communication.
* IIA GTAG - "Auditing IT Governance"
* IIA GTAG - "Managing Third-Party Risks"
* IIA Standard 2110 - Governance
Analysis of Answer Choices:IIA References: