CISM: Certified Information Security Manager

A payroll-processing vendor must be contractually bound to the organization’s information security policies so that its handling of sensitive employee data meets the organization’s defined security requirements, risk tolerance, and applicable obligations. Third-party service providers should conform to the supported organization’s security policies and procedures.