(1) Take reasonable steps to select and retain third-party service providers that are capable of maintaining appropriate security measures to protect such personal information; and
(2) Require such third-party service providers by contract to implement and maintain such appropriate security measures for personal information