(1) indications that the information is in the physical possession and control of an unauthorized person, such as a lost or stolen computer or other device containing information; or
(3) assesses the sufficiency of safeguards in place to control the identified risks;
(4) regularly tests and monitors the effectiveness of key controls, systems and procedures; and
