(1) The Commission shall take reasonable steps to monitor providers' compliance with relevant vendor measures.

(2) For the purposes of subsection (1), the Commission may serve a direction on a provider which may require the provider to do one or more of the following:

(a) to provide information needed to assess whether a provider has complied with a relevant vendor measure taken by the Minister;

(b) where the Commission has reasonable grounds to believe that a provider is failing, or has failed, to comply with a relevant vendor measure, to provide a statement to the Commission indicating what measures the provider has taken to comply with the measure and, where the provider has failed to comply with the measure, explaining the reasons for such failure;

(c) to submit to a security audit referred to in subsection (3) by the Commission or a qualified independent person nominated by the Commission and to make the results of any security audit not carried out by the Commission available to the Commission;