. " The standard includes such requirements as policies, controls, physical" . . .