If the entity being assessed is a service provider:
Describe how observed customer password files verify that customer passwords are encrypted during:
i. Transmission
ii. Storage
Describe how observed system configuration settings confirm that customer passwords are rendered unreadable using strong cryptography during:
i. Transmission
ii. Storage