ExPat, Not mentioned here (or at least clearly) but they now need to have a Information Security Officer.