Recommended Control 2: of the company providing the information technology services and functions. Where an agency has outsourced information technology services and functions, they should ensure that the outsourced organization provides a single point of contact within the organization for all information assurance and security matters Outsourcing is contracting an outside entity to provide essential business functions and processes that could be undertaken by the Agency itself. If an agency engages an organization for the provision of information technology services and functions, and where that organization also provides the services of an Information Technology Security Manager, they need to ensure that there is no actual or perceived conflict of interest (See also Section 6.3 ‐ Information Technology Security Managers). When an agency engages a company for the provision of information technology services and functions, having a central point of contact for information security matters within the company will greatly assist with incident response and reporting procedures. 11