U.S. Securities and Exchange Commission, Office of Information Technology, SEC, Private Impact Assessment Guide (Jan. 2007) (full-text).