This policy has a variety of statutory, regulatory and internal obligations to process this information in a way that assures its confidentiality, quality and availability at all times. Security can be compromised by vulnerabilities or inadequacies in the design and maintenance of these systems. ‘Systems’ in this policy include infrastructure, commercial off the shelf packages, external systems, operating systems, business applications and user developed systems, in any format, e.g. paper or electronic.