Organisations must also ensure that the associated risks are appropriately managed and that the control of externally provided processes and products includes appropriate measures for security assurance and management of changes to documents, agreements, and procedures.