Current controls in place where the risks have been identified, assessed, and mitigated, but risks have not scored to acceptable level.
Efforts should be made to reduce the risk level. The risk mitigation and control measures shall be established and implemented.