Certification requires us to:
- Systematically evaluate our information security risks, taking into account the impact of company threats and vulnerabilities
- Design and implement a comprehensive suite of controls and other forms of risk management to address company and architecture security risks
- Adopt an overarching management process to ensure that the controls meet our information security needs on an ongoing basis