CGRC - Assessment/Audit of Security and Privacy Controls - Resource Identification for Risk Mitigation