To ensure that appropriate policies and procedures are developed and followed, HIV/AIDS surveillance programs designate an ORP, who is responsible for security of the program's information collection and management systems, including processes, data, information, software, and hardware.