Quiana is writing a report for customers for whom she has just completed a risk assessment. She is describing controls that are ineffective or missing, and she is making recommendations for controls the customers could implement if they cannot implement ideal controls due to resource constraints. Which of the following describes the types of controls Quiana is suggesting in place of the preferred controls that could also help reduce risk?