Because service providers often are recognized as the “weak link” in any corporate privacy management program, federal and state laws have adopted requirements to address this risk to the protection of personal information.11 Among the governing laws, enforcement actions, and industry standards requiring service provider management of regulated personal information are the following: