The information controller establishes the applications for which as well as suggests by which private info is processed. Includes a new illustrative report That could be applied when performing and reporting on a SOC 2+ evaluation. Requirement 8 now goes further than just demanding a singular ID for All and https://www.nathanlabsadvisory.com/nist-800-171.html