exercise its discretion or make decision in the operation for the intermediary; “end user” means the employees of the intermediary and contractors who engage in the operation and has access to the sensitive

sensitive information or the organization’s critical information systems, but excluding the clients; “ information processing facility ” means any equipment, operating systems, or infrastructure that are