Which of the following would BEST help to ensure compliance with an organization’s information security requirements by an IT service provider?

Defining the business recovery plan with the IT service provider

Requiring an external security audits of the IT service provider

Defining information security requirements with internal IT

Requiring regular reporting from the IT service provider