This includes an ongoing security risk management programme, prioritising the protection of strategic assets and identification of high-risk vendors and other third-parties to ensure that they properly handle and protect personal data.