smart card deployment sox smart card module compliance hipaa development oxley sarbanes sdlc security program manager audit consulting security threat model change management