You need a written security policy, but that was pretty close to pro forma. The compliance firm wrote us one which we disseminated appropriately.

You basically just need to follow some reasonable security standards. Firewalls, ssh/ssl admin terminals, no shared credentials, and then follow a basic security policy.