The licensee monitors, evaluates, and adjusts, as appropriate, the information security program in light of any relevant changes in:

1. (1) Technology;
2. (2) The sensitivity of its customer information;
3. (3) Internal or external threats to information; and

4. (4) The licensee’s own changing business arrangements, such as:

   1. (A) Mergers and acquisitions;
   2. (B) Alliances and joint ventures;
   3. (C) Outsourcing arrangements; and
   4. (D) Changes to customer information systems.