MDCG 2019-16 Part 5 – Practice 1 – SM-4: Security expertise, SM-5: Process scoping