CGRC - Selection and Approval of Framework, Security, and Privacy Controls - Mitigating Controls