Mechanisms exist to govern how external parties, systems and services are used to securely store, process and transmit data.
Does the organization govern how external parties, systems and services are used to securely store, process and transmit data?