Audit report 07 09 18 37, covering information security policies and review, organisation of information security, asset management, physical protection, operations security, encryption and access control.