An organization has outsourced its billing function to an external service provider. Who should own the risk of customer data leakage caused by the service provider?

A third-party vendor has offered to perform user access provisioning and termination. Which of the following control accountabilities is BEST retained within the organization?