What needs to be decided prior to considering the treatment of risks?
A. Criteria for determining whether or not the risk can be accepted
B. How to apply appropriate controls to reduce the risks
C. Mitigation plans
D. The development of own guidelines