An operator must develop and implement a Security Policy which addresses security matters which include but are not limited to the following:
(a) Security risk assessment within the railway operations;
(b) security management;
(c) the development and Implementation of the Security Management Plan;
(d) monitoring of compliance with the Security Management Plan;
(e) the operators Audits and Inspections;
(f) review of the Security Policy; and
(g) communication, education and awareness.