Control Objective (Goal)
Security risk (Assessment)