the first one is to develop and maintain policies and procedures, including for such things as permissions, access controls, and acceptable formats for filing records needed for a long period of time.