CISF deployment in private sector units is based on threat assessment, criticality, and payment for services.