We recommend that NARA develop and implement formalized procedures to ensure for those systems utilized by NARA and managed by Cloud Service Providers, controls for which NARA has a shared responsibility should be reviewed on an annual basis, documented and assessed as to the impact to NARA of any risks that may be present.