One can implement that policy by taking specific actions guided by management control principles and utilizing specific security standards, procedures, and