(3) Security Controls Implementation - The security plan
for each tenant describes the security controls to be
implemented by each involved stakeholder based on the
security control category (common, service specific). The
common security controls implementation is the
responsibility of the common control provider who may be
the CPs (in case of internal security controls) or the CC (in
case of external controls). The service-specific security
controls implementation is the responsibility of the SPs.
Each stakeholder must document the security controls
implementation configurations in the security mgmt plan.