Requirement 12.1

Establish, publish, maintain, and disseminate a security policy that accomplishes the following: