CompTIA Security+ (SY0-701) SY0-701 — Question 355

Several customers want an organization to verify its security controls are operating effectively and have requested an independent opinion. Which of the following is the most efficient way to address these requests?