e change control, they are identified separately here because there are often outside 
services that compile and circulate information on security issues and updates. At a 
minimum, repositories should be monitoring these services to ensure that repository-held 
data is not subject to compromise by identified threats. 
5.1.1.5 The repository shall have defined processes for storage media and/or 
hardware change (e.g., refreshing, migration). 
Supporting Text 
This is necessary in order to ensure that data i