The organization shall map, document, authorize and when changes occur, update, all external services and the connections made with them.
The flow of information to/from external systems shall be mapped, documented, authorized, and update when changes occur.