Oversee service provider arrangements.

The licensee:

(1) Exercises appropriate due diligence in selecting its service providers.

(2) Requires its service providers to implement appropriate measures designed to meet the objectives of this chapter, and, when indicated by the licensee’s risk assessment, takes appropriate steps to confirm that its service providers have satisfied these obligations.