5.4 The APMU  shall develop, maintain, implement and ensure ongoing compliance with a written information security program that includes physical, organizational, technical, environmental and operational safeguards appropriate to the sensitivity of the information in its custody or to which it has access.