Defining the right level of security for client assignments involves setting the acceptable exposure to risk, performing a risk assessment and describing the organisational, process-related and technical security measures that must be implemented.