Watch this video on YouTube
An IS auditor reviews a vendor providing data processing services. The vendor does not undergo regular independent security assessments. What is the MOST appropriate audit recommendation?