The asset owner shall have policies and procedures around protecting network accessible services from unauthorized network access.