What is the client's industry and regulatory environment? - What triggered this engagement (compliance requirement, incident response, new deployment)? - What are the crown jewel assets --- the data or systems that would cause the most damage if compromised? - What is the client's security maturity