Third-party provider

Control system
A third-party provider includes

"service bureaus, contractors, and other organizations providing control system operation and maintenance, development, IT services, outsourced applications, and management|network and security management. The organization explicitly includes personnel security controls in acquisition-related contract and agreement documents."