Decision to mitigate a risk using controls, or changes in the organization or the techniques used to reduce its likelihood or its negative consequence if the risk happens.