> I think a much better question would be "how are information security and privacy controls implemented"

Agreed, that's a great question to ask.