The CPSC should review the external service provider’s customer responsibility matrices,select, tailor, implement the relevant security controls from those matrices and thendocument (and periodically reassess) those controls to support the ongoing…

The CPSC should review the external service provider’s customer responsibility matrices,select, tailor, implement the relevant security controls from those matrices and thendocument (and periodically reassess) those controls to support the ongoing authorizationto operate and use decision.