Which of the following should be of GREATEST concern to an information security manager when...

The lack of audit rights prevents the organization from verifying the security posture and compliance of the provider, representing a major governance and assurance gap.

“Right to audit clauses ensure that organizations retain oversight and can verify the security controls and compliance of their service providers.”

— CISM Review Manual 15th Edition, Chapter 3: Outsourced Services, Section: Third-Party Governance*

Control inadequacy can be fixed; lack of oversight cannot be tolerated.