In a remote assessment, which of the following is true?

• A. Third party completes questionnaire
• B. Assessors conduct a physical site visit
• C. Independent audits are unnecessary
• D. The vendor's marketing materials are reviewed

Answer: (A)

In a remote assessment, evidence collection centers on standardized information provided directly by the vendor or a third party, typically through a questionnaire. This self-reported data allows the assessor to gather uniform details about controls, implementations, and risk factors without needing to visit a site. It supports scalable evaluation across many vendors and can be supplemented with requested documents or virtual interviews, but the core mechanism is the questionnaire completed by the third party.

Physical site visits are not part of a purely remote process, which is why that option doesn’t fit. Independent audits aren’t inherently unnecessary—they can provide valuable assurance but aren’t a required element of remote data collection. Marketing materials aren’t reliable evidence of a control environment for assessment purposes.