Determine minimum-required security controls based on aggregate score, Risk Management