(a) A contractor must develop, maintain, and comply with written policies and procedures to promote the safety and security of program participants, employees, and volunteers as appropriate for the project. The written policies and procedures must address technology safety and data security.(b) If the special nonresidential project provides direct services, the contractor must have a security system that is operational 24 hours a day. The security system may include, but is not limited to an alarm system, special lighting, dead bolts, and agreements with local law enforcement.