Independent attestations that may be used in due diligence include:

• A. Penetration test, vulnerability test, audits
• B. Employee performance reviews
• C. Marketing metrics
• D. Brand recognition surveys

Answer: (A)

Independent attestations used in due diligence are external evaluations that provide objective evidence about a target’s security controls and risk posture. Penetration testing, vulnerability assessments, and audits fit this role because they involve formal, independent examination of security measures and compliance.

A penetration test actively tries to breach defenses to show whether they can be overcome in real-world conditions. A vulnerability assessment scans systems for weaknesses that could be exploited. Audits provide an independent review of controls and procedures against standards or policy requirements. Together, these offer tangible assurance about how well the organization protects data and manages risk.

By contrast, internal HR reviews of employee performance, marketing metrics, or brand recognition surveys don’t provide independent assurance about security controls or risk mitigation. They measure different aspects (personnel performance, marketing outcomes, or brand awareness) and don’t directly attest to the effectiveness of security or risk controls needed for due diligence.