Appropriate oversight may include, but is not limited to, reviews of relevant annual reports, independent assessments, attestations, certifications, and various standardized accounting audit and information security evaluations (e.g., SSAE penetration testing, and ISO 27001 certifications).