Domain 5: Assessment/Audit of Security and Privacy Controls