1. Despite operating a patch management program, your company has been exposed to several attacks over the last few months. You have drafted a policy to require a lessons learned incident report be created to review the historical attacks and to make this analysis a requirement following future attacks. How can this type of control be classified? 2. A bespoke application used by your company has been the target of malware. The developers have created signatures for the application's binaries, and these have been added to endpoint detection and response (EDR) scanning software running on each workstation. If a scan shows that a binary image no longer matches its signature, an administrative alert is generated. What type of security control is this? 3. Your company is interested in implementing routine backups of all customer databases. This will help uphold availability because you will be able to quickly and easily restore the backed-up copy, and it will also help uphold integrity in case someone tampers with the database. What controls can you implement to round out your risk mitigation strategy and uphold the components of the CIA triad