Ensure that security policies and operational procedures for security monitoring and testing are documented, in use, and known to all affected parties.