Audit report 12 09 18 41, covering access control, operations security and cryptographic controls.