Granting remote access to a system containing sensitive data to an overseas third party poses various risks to the organization, such as data breaches, unauthorized access, data loss, compliance violations, or reputational damage. The greatest concern to management when granting remote access to a third party is the lack of monitoring over vendor activities, meaning that the organization may not be able to control or verify how the third party is accessing, using, storing, or transferring the sensitive data. The lack of monitoring over vendor activities can increase the risk exposure and uncertainty of the organization, as well as reduce the accountability and transparency of the third party. Therefore, the organization should implement appropriate measures to monitor and audit the vendor activities, such as logging, reporting, reviewing, or testing, and to ensure that the vendor complies with the contractual obligations and the security policies and standards of the organization. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.2.1, p. 243-244