Basically, you do not prepare anything prior to the risk assessment. In general, we require the support of internals to whom we can direct our questions, either remotely via questionnaire or on-site. In addition, we need your company’s full documentation in terms of data protection.