Customers and clients entrust the organisation with their own Assets — their data, their money, or their trust in a service being available and correct. They are often the party that ultimately bears the harm if a Risk materialises, even when the failing Control sits entirely inside the organisation.

Where the data being processed is about the customer, they are also a data subject in the legal sense (see Identified or identifiable person). Contractual SLAs and, in regulated sectors, statutory obligations often give customers rights and expectations that directly shape which controls are considered mandatory rather than optional.