security policy and audit readiness