write a short recommendation on security controls that if implemented would have served to mitigate the incident