Reviewing proposed privacy rules that govern the processing of personal data is the most useful action to help define the scope of the project because it helps identify the legal and regulatory requirements, the data protection principles and the privacy objectives that the information security controls need to support. Reviewing recent audit reports, identifying databases that contain personal data or do not have encryption in place are helpful actions to assess the current state of privacy and security, but they do not provide a clear direction for the project scope.