23. Suspension and revocation
24. Procedure following suspension
25. Termination
26. Information security requirements
27. Audits and evaluations
28. Administration and supervision
