Cybersecurity operations, IT infrastructure security management, Implementation of security controls and policies, Cybersecurity risk assessments and audits