An organization's board of directors has asked the Chief Information Security Officer to build a third-party management program. Which of the following best exp...