In March approved its first Information Security Policy, documenting key roles and responsibilities within the organization to ensure that accountability is assigned to appropriate individuals and authorities and that employee training needs are met.