an organization is planning to deploy an e-commerce site hosted on a web farm. it administrators have identified a list of security controls they say will provide the best protection for this project. management is now reviewing the list and removing any security controls that do not align with the organization's mission. what is this called?