Ratio Corp has identified a potential security risk to its new information system and needs to implement additional security controls to mitigate the risk. Which of the following is the best approach for selecting and implementing the additional security controls?