Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some ris...