12 Maintain a policy that addresses information security for employees and contractors. All items in requirement 12 may be controlled by business procedures and policy. With the proper business controls in place, OpenBSD is compliant with requirement 12.