These policies and standards establish individual controls for user access management (including access control and passwords), privileged access management, change management, security incidents, data handling and destruction, and other security measures.