Require that providers of external system services employ organization-defined controls.
No STIG checks reference this CCI.