Using the Secure Controls Framework (SCF) as the baseline the answer to the question is below. Essentially it’s all about risk reduction and minimizing the risk your business feels comfortable absorbing “Risk Tolerance”. The lower your risk footprint “Appetite” the lower the impact from these gaps which increases your risk level. Knowing these three concepts will go along way to understanding your risk and what to do about them.