develop, recommend, or manage security procedures for operations or processes, such as security call centers, system acquisition, development, and maintenance, access control, program models, or reporting tools.