Key policies and interventions include: Group Information Security Management Policy, Group Privacy and Data Protection Policy, Group ICT Secure Configuration standard, Group Cyber Incident Response Plan, annual cyber penetration tests and cyber risk audits.