Security controls is the correct option.

An information security management system is a management framework that defines leadership, planning, support, operation, performance evaluation, and continual improvement to manage information security risks and meet legal and contractual obligations. Security controls are the specific technical and procedural measures that an organization implements as part of that framework to treat risks and enforce requirements, but they are implementation elements rather than one of the ISMS core management components.

Compliance with applicable laws and regulations is not correct because legal and regulatory compliance is an essential requirement that an ISMS must address and it therefore forms part of the system scope and objectives.

Risk assessment is not correct because identifying and assessing information security risks is central to an ISMS and drives selection of controls and treatment plans.

Continual improvement processes is not correct because continual improvement is a core principle of management systems and it is explicitly required by ISO/IEC 27001 through the plan do check act approach and performance evaluation activities.

Full AWS Practitioner Certification Question