In the third stage the roles change on the CWMP level.
As vital data (like user names and passwords) may be transmitted to CPE via CWMP, it is essential to provide a secure transport channel and always authenticate the CPE against the ACS.