- Conduct a periodic assessment that examines:
- The nature, sensitivity and location of information that the firm collects, processes and/or stores, and the technology systems it uses
- Internal and external cybersecurity threats to and vulnerabilities of the firm’s information and technology systems
- Security controls and processes currently in place
- The impact should the information or technology systems become compromised
- The effectiveness of the governance structure for the management of cybersecurity risk