Organizations that rely on third-party vendors for IT services must ensure secure and controlled communication, especially in areas where external connections are involved. External connections typically include:

Cloud services (e.g., SaaS, PaaS, IaaS)

Third-party APIs

Remote access (VPNs, firewalls, network gateways)

IoT devices and external sensors

These connections introduce cybersecurity risks, requiring continuous monitoring, vendor communication, and security controls.

(A) Applications.

Incorrect. While application security is important, it is typically managed internally. Vendor involvement is needed for software patches and updates, but communication is not as tightly monitored.

(B) Technical infrastructure.

Incorrect. This layer includes internal IT components like servers, databases, and networks, which are mostly managed in-house. Vendor involvement is required for hardware/software updates but not to the same extent as external connections.

(C) External connections. ✅

Correct. External connections require tightly controlled communication with vendors to prevent security breaches, unauthorized access, and data leaks.

IIA GTAG "Auditing IT Governance" highlights third-party risk management as a key area for IT audits.

IIA Standard 2110 requires organizations to establish governance structures for vendor and IT security management.

(D) IT management.

Incorrect. IT management focuses on internal oversight of IT policies and compliance, but does not necessarily require tightly controlled vendor communication.

IIA GTAG – "Auditing IT Governance"

IIA GTAG – "Managing Third-Party Risks"

IIA Standard 2110 – Governance

Analysis of Answer Choices:IIA References: