Looking at an organization's processes, identifying where and how much data could be accessed inappropriately, and taking steps to prevent it.