Ensure that security policies and operational procedures for identification and authentication are documented, in use, and known to all affected parties.