The practice should ensure they have policies for Asset Management Access Controls Cryptography Physical Security Communications Security Operations Security Systems Maintainance Business Continuity and Disaster Recovery Customer Responsibilities