process (e.g., policies, methods, procedures, devices or programmed
mechanisms intended to protect the confidentiality, integrity or
availability of information) have been developed
4. Determining whether security requirements are being met effectively.