The Supplementary Information accompanying the final rule states in this
The final rule includes supplementary information and outlines some information.
Security policies are the foundation of those organizations' information security programs.