Activate, implement, and maintain controls to mitigate risks