Once a risk is identified and assessed, risk treatment and response options (including decisions to mitigate, transfer, accept and respond, or control the risk) are identified and evaluated based on a number of factors, including cost effectiveness, impact to operations, scalability and feasibility of execution.