Does the system process, store, or transmit regulated data (PII, PHI, PCI)? - What is the regulatory impact of a breach?