CCS passes software to Security Policy, under PoP. SP3 "Logical Security" and SP4 "Operational Security". Publication of Policies is by means of /policy/ directory and is thus part of software patching. Mailout to Members from online system is done by Application (online CA) software.