Key components of that program include a principles-based policy that is supported by an infrastructure of procedures, job aids, training, and other materials governing the collection and use of personal information.