Our enterprise IT security policy and related standards are based on various industry best practices, including but not limited to the National Institute of Standards and Technology and the International Organization for Standardization.