Start your mitigation effectiveness assessment by establishing:
- Data classification levels and what they entail
- Your IT systems elements and where they reside
- How much detail you want to dive into the assessment
This phase will establish a foundation from which to launch the assessment.