See below for the practice statement on management, operational and physical controls.