All commercial and nonprofit entities that deal directly with the public must “develop and implement” policies requiring face coverings for employees and visitors.