An organization learns that a third party has outsourced critical functions to another external provider. Which of the following is the information security man...