There shall be determination of the relative significance for each risk, and implementation of appropriate procedural and physical controls, to control the identified risks and ensure regulatory compliance.