These risk management controls include but are not limited: architecture reviews, SSAE audits and review of vendor SOCand SOC2 Type II reports for critical and SOX vendors, ongoing monitoring and reporting of vendor security by an independent third party, vulnerability assessments conducted internally and annually by an external third party, data protection impact assessment, annual enterprise risk assessment, incident response and notification procedures, and Data Protection Agreements including standard contractual clauses (SCCs) for privacy compliance.