In order to set up baselines for the controls of Security And Data Protection Management, the Engagement Manager must conduct an assessment of the controls against the risks for the business of the Client and Capgemini. The assessment needs to be conducted and agreed upon with client representatives for Security And Data Protection Management.

Factors that should be considered in this assessment:

• Business criticality and potential risks.
• Specific demands regarding data protection due to factors such as cross border transfer, critical domain specific data, privacy by design etc.
• Specific legal regulations.
• Demands of the business partners of the Client.
• Specific demands regarding access management.
• Data processing risks associated with supplier
• Assets, Data and Information.