controls are managed and maintained in accordance with established Information Security policies, standards and procedures... and threats based on industry security frameworks and recommends appropriate mitigation. Periodically assesses the information...