. . . "security programs and practices, such as the C & A" . .