premise: This category includes entitywide security program planning, management, control over data center operations, system software acquisition and maintenance, access security, and application system development and maintenance.
hypothesis: There is no entity wide security program.