New Jersey Data Privacy Act 56:8-166.16(d): Security appropriate to risk with a clear allocation between controller and processor

What does 56:8-166.16(d) require?

Taking into account the context of processing, the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk and establish a clear allocation of responsibilities between them for implementing those measures.