Compare and contrast risks associated with penetration testing with not performing penetration testing. What NIST control is this? Consider specifically the environment associated with executing the pen testing and list no more than five specific controls (not control families) that would reduce the risk associated with penetration testing. In other words, what would you do to prepare to mitigate risk from conducting pen tests?