; (ii) the nature and scope of the activities of the ticket issuer; (iii) the sensitivity of any customer information at issue; and (iv) the range of security risks and vulnerabilities that are reasonably foreseeable or known to the ticket issuer. (C) Third parties and service providers (i) In general Where applicable, a ticket issuer that owns or operates an internet website or online service that facilitates or executes the sale of event tickets shall implement and maintain procedures to require that any third party or service provider that performs services with respect to the sale of event tickets or has access to data regarding event ticket purchasing on the website or service maintains reasonable administrative, technical, and physical safeguards to protect the security and integrity of the website or service and that data. (ii) Oversight procedure requirements The procedures implemented and maintained by a ticket issuer in accordance with clause (i) shall include the following: (I) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue. (II) Requiring service providers by contract to implement and maintain adequate safeguards. (III) Periodically assessing service providers based on the risk they present and the continued adequacy of their safeguards. (D) Updates A ticket issuer that owns or operates an internet website or online service that facilitates or executes the sale of event tickets shall regularly evaluate and make adjustments to the safeguards described in subparagraph (A) in light of any material changes in technology, internal or external threats to system security, confidentiality, integrity, and availability, and the changing business arrangements or operations of the ticket issuer. (3) Requirement to report incidents of circumvention