Mechanisms exist to control personnel security requirements including security roles and responsibilities for third-party providers.