[alex mercer]

A broad right to audit can be costly and hard to exercise. How should a buyer make it practical?

[Ethan Cole]

Accepted answer

Tie audit rights to material risks such as security, privacy, usage billing, license compliance, service levels, records, and subcontractors. Define evidence available routinely, independent reports, notice, access limits, confidentiality, cost allocation, remediation, and rights after a serious incident. Use the least intrusive evidence that addresses the risk. NIST SP 800-161 Rev. 1 supports ongoing supplier-risk monitoring.

[Jordan Blake]

Community reply

Can a buyer rely on independent reports instead of keeping a direct right to inspect records after an incident?

[Author]

Posts