Which two aspects of external provider behaviour does the Community Profile say should be monitored? Choose two.

Answer: B. Remote and on-site administration and maintenance the provider performs on the organisation's systems
D. Deviations from expected behaviour by cloud services and internet service providers

SP 800-61r3 recommends monitoring external service provider activities include remote and on-site administration and maintenance activities performed on organisational systems, and deviations from expected behaviour by cloud-based services, internet providers and others.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.CM-06.R1