Correct me if I'm wrong, but isn't this the same standard required by the PPA for pretty much every private company?

http://thomas.loc.gov/cgi-bin/bdquery/z?d109:HR00004:@@@L...;