"The elements are set out in four separate categories: Institutional policy and procedures IT Infrastructure: the hardware, software and other facilities which underpin data-related activities" . . . . .