Which of the following is the fastest and most cost-effective way to confirm a third-party supplier's compliance with security obligations?

An attestation report is the fastest and most cost-effective way to confirm a third-party supplier's compliance. It is a statement by the supplier, often supported by an independent auditor's opinion, confirming their adherence to specific security controls. This is quicker and cheaper than commissioning a full third-party audit yourself. A third-party audit involves an independent firm conducting a comprehensive review, which is thorough but more time-consuming and expensive. Vulnerability assessments identify weaknesses but don't confirm overall compliance with obligations. Penetration testing actively exploits vulnerabilities to test defenses, which is valuable but not a broad compliance confirmation and can be costly.