This obligation extends to any outsourced providers of your business operations and services and as a result, you should ensure that systems are in place to identify and respond to any so identified.