12 Maintain a policy that addresses information security for employees and contractors. All items in requirement 12 may be controlled by business procedures and policy. With the proper business controls in place, Debian GNU/Linux 5.0 (Lenny) is compliant with requirement 12.