Q15
Single choice
An auditor asks an organization to prove that its software as a service provider operates effective security controls. The organization cannot inspect the provider's data center directly.
Which evidence should the organization request?