An organisation has to determine, first and foremost, whether they need to rely on externally provided products and services. And they need to identify all those externally provided products and services, what risk they bring to the business, and what controls they have in place associated to that.