The external auditor determined that our ISP was reasonably designed to protect the security, confidentiality, and integrity of consumers’ personal information collected by the Covered Services, and further, that we were in compliance with our program.