Comment by Mesmoria

I note that section 1.6 is "Comply with all industry security standards relevant to your business such as PCI DSS, HITRUST, ISO27001, and SSAE 18".

That looks larger than all the other requirements.