Adopts ISO27002:2013, including Amendment1:2014, which provides guidelines for organizational information security standards and information security management practices including the selection, implementation and management of controls taking into consideration the organization's information security risk environment(s).