CGRC - Assessment/Audit of Security and Privacy Controls - Risk Response Options: Avoid, Accept, Share, Mitigate, Transfer