These policies range from general management (risk assessment and management, document management and legal requirements etc.), to more theme-specific policies and procedures on a wide range of critical risk controls.