The most effective method to verify that a service vendor keeps control levels as required by the client is to conduct periodic on-site assessments using agreed-upon criteria. On-site assessments can provide direct evidence of whether the vendor’s controls are operating effectively and consistently in accordance with the client’s expectations and requirements. Agreed-upon criteria can ensure that the assessments are objective, relevant, and reliable. The other options are not as effective as on-site assessments in verifying the vendor’s control levels. Periodically reviewing the SLA with the vendor can help monitor whether the vendor meets its contractual obligations and service standards, but it does not provide assurance of whether the vendor’s controls are adequate or sufficient. Conducting an unannounced vulnerability assessment of vendor’s IT systems can help identify any weaknesses or gaps in the vendor’s security controls, but it may violate the terms and conditions of the vendor-client relationship or cause operational disruptions. Obtaining evidence of the vendor’s CSA can provide some indication of whether the vendor’s controls are self-monitored and reported, but it does not verify whether the vendor’s controls are independent or accurate. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4