Your clients will tell you about their concerns. Whether it's HIPAA, PCI, PABP, SOX, ITAR, etc., they tend to be overly expressive and understanding. They're also very similar and once you've nailed it a few times, whether it's "securing privileged information," "transparency," "traceability," etc., a quick browse of the Wikipedia article can warn you of any specifics that are outside your experience.