Inability to show evidence of due diligence when choosing an outsource provider specifically having reviewed any relevant restrictions imposed in their jurisdiction (for example, access to customer data from cloud computing providers) 