; (ii) with reckless disregard to a substantial risk of causing injury without legal justification; or (iii) for a purpose unrelated to the performance of any responsibility or function— (I) set forth in paragraph (1); or (II) pursuant to sections 2258A, 2258C, 2702, or 2703. (3) Vendor cybersecurity requirements With respect to any visual depiction provided pursuant to the duties of NCMEC under section 404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention Act of 1974 ( 34 U.S.C. 11293(b)(1)(K) ) that is stored or transferred by a vendor contractually retained and designated by NCMEC to support such duties of NCMEC, a vendor shall— (A) secure such visual depiction in a manner that is consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of Standards and Technology, or any successor thereto; (B) minimize the number of employees that may be able to obtain access to such visual depiction; (C) employ end-to-end encryption for data storage and transfer functions, or an equivalent technological standard; (D) undergo an independent annual cybersecurity audit to determine whether such visual depiction is secured as required under subparagraph (A)