Step 3 – Evaluate the risks and implement controls