requirements for periodic reviews, managementRequired oversight, and configuration management.
They have requirements for periodic reviews.