Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using organization-defined restrictions.