What security and other measures represent the minimum thresholds for externally hosted corporate services?