* An attestation from a reputable accounting firm provides an independent, validated assessment of the vendor's security controls, offering credibility and assurance.
* Such attestations typically include assessments like SOC 2 Type II reports or ISO 27001 certifications, which evaluate the effectiveness of implemented security measures.
Why Other Options Are Less Suitable:
* A. Client list: While informative, it does not provide direct evidence of the vendor's security posture.
* C. Client references: These may highlight successful implementations but lack independent verification of security controls.
* D. Internal risk assessment: Vendor-produced documents may be biased and not independently verified.
EC-Council CISO Reference:
The program emphasizes the value of third-party attestations and certifications as reliable indicators of a vendor's compliance and security maturity.

Comprehensive and Detailed Explanation (250-350 words) From Exact Extract from Chief Information Security Officer (CCISO) Documents:
The EC-Council CCISO Body of Knowledge repeatedly emphasizes alignment to the business as a foundational principle when evaluating security controls. CCISO guidance states that controls must support operational objectives, not impede them.
Least privilege and fiduciary oversight are important control concepts, but CCISO materials highlight that the CISO's primary responsibility is ensuring controls enable business operations while managing risk.
Therefore, alignment to the business is the correct and CCISO-validated answer.

Purpose of a Business CaseA business case for a security project is developed to:
* Communicate risks to stakeholders.
* Provide a justification for resource allocation and investment.
* Forecast budgetary and resource requirements.
Comparison of Options
* A. Estimate risk and negate liability: Business cases estimate risk but do not primarily negate liability.
* B. Understand attack vectors and sources: While important, this is not the primary focus of a business case.
* D. Forecast usage and cost per software licensing: This may be part of a business case but is not its primary purpose.
EC-Council References
* Emphasized in EC-Council frameworks, a business case is essential for aligning security projects with organizational priorities and securing executive buy-in.