The scope of these control standards includes staff training in identifying potential signs of vulnerability, the need to consider vulnerability requirements within the development of new products and services, and operational arrangements for supporting customers identified as vulnerable.