evaluating business strategies and requirements following a risk-based approach, and describe associated data flows and security controls...