(1) The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization: (i) can verify the employment of required security controls on the external system as specified in the organization’s information security policy and system security plan; or (ii) has approved information system connection or processing agreements with the organizational entity hosting the external information system.