GSE third-party service providers increasingly have their own third parties that could also pose a risk to the enterprises.