According to IIA guidance, which of the following would be the best first step to...

Creating a comprehensive reporting system for vendors to demonstrate their ongoing due diligence in network operations

Drafting a strong contract that requires regular vendor control reports and a right-to-audit clause

Applying administrative privileges to ensure right-to-access controls are appropriate

Creating a standing cybersecurity committee to identify and manage risks related to data security