uality of third party 
services. The repository may conduct overall risk assessments with tools such as 
DRAMBORA.2 
5.2.2 The repository shall have implemented controls to adequately address each of 
the defined security risks. 
Supporting Text 
This is necessary in order to ensure that controls are in place to meet the security needs of the 
repository. 
Examples of Ways the Repository Can Demonstrate It Is Meeting This Requirement 
Repository employs the codes of practice found in the ISO 27000 series of