The asset owner shall have policies and procedures related to protecting sessions from unauthorized access and modification.