When dealing with third parties, which of the following is NOT a way to ensure a level of security that the data involved warrants?

Include contract clauses that detail the exact security measures that are expected of the third party.

Allow for specific implementation of a security measure to be determined by the third party.

Consider executing a Interconnection security agreements $($ISA$)$ which in some areas, such as healthcare, may be required.

Periodically audit and test the security provided to ensure compliance.