Create, maintain, communicate, and enforce security and privacy policies, standards, baselines, procedures, exceptions, and technical mappings.