emily is the information security director for a large company that handles sensitive personal information. she is hiring an auditor to conduct an assessment demonstrating that her firm is satisfying requirements regarding customer private data. what type of assessment should she request?