#sans 10400-xa requirements