anchor: This category includes entitywide security program planning, management, control over data center operations, system software acquisition and maintenance, access security, and application system development and maintenance.
positive: There is an entity wide security program.
negative: There is no entity wide security program.