Three boundaries CSFS must make explicit

Commercial boundary: what CSFS promises directly, what a solution partner promises and what the customer owns.

Operating boundary: who monitors, who responds, who can take action and what happens when systems fail.

Data boundary: what CSFS receives, where it resides, how consent works and when information is deleted.