A company should have the right to audit evidence of controls to verify compliance with its security requirements, applicable controls, and other contractual agreements. Vendors should preserve and produce, upon request, copies of data relevant to the services provided to customers. Audit rights should include…