The	company	also	has	 three internal policies (Cyber and Information Security Policy, Acceptable Use of IT Assets Policy and Acceptable Use of Mobile Devices Policy), which	provide	further	guidance	on	the	management	of	data	security	risks.