CRISC - Domain 3: Risk Response and Reporting - Risk Response Options