Acceptable based on risk/impact mitigation. It might require management decision: No additional controls are required. However, consideration may be given to a more cost effective solution or improvement that imposed no additional cost burden, monitoring is required to ensure that the control are maintained.