This guidance is aimed at service owners and security specialists involved in the provision of online services.