Security risk assessments are completed at least annually and consider the following: Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure Compliance with defined retention periods Data classification and protection from unauthorized use, access, loss, destruction, and falsification