Guide and assist identify all reasonably foreseeable internal and external risks to personal information in a responsible party's possession or under its control, and establish and maintain appropriate safeguards against the risks identified.

More to follow.