Situation: We have several suites of offices and determined all suites are CUI areas as every employee working uses CUI with minor exceptions. We have an monitored alarm system to detect breaks ins for the suites. The service that monitors the system is a hosted service called alarm.com which we can log into via the web to see such things as who armed\disarmed the system, set user codes, etc. My thought is that this would be an SPA, which then would mean the monitoring company would have to meet the 800-171 controls for the data collected from the alarm panels. However the vendor I work with (reseller of the service) says no, we even have contracts with the military and don't need to do this. So I am confused and looking for any guidance you may have on this topic.