The entity demonstrates a commitment to integrity and ethical values.

The board of directors demonstrates independence from management.

Management establishes structures, reporting lines, and authorities.

The entity demonstrates commitment to attract and retain competent individuals.

The entity holds individuals accountable for their internal control responsibilities.

The entity implements logical access security software and infrastructure.

Prior to issuing credentials, the entity registers and authorizes users.

The entity removes access when users no longer require it.