to the IT Standard Rules this time are summarized as follows: (1) Establishing IT-related risk assessment criteria to define the entity’s risk level and to specify standards of IT security controls