When multiple controls address the same risk, the BEST approach is to select those that:

1. AReduce risk most efficiently for the cost
2. BAre the most technically complex
3. CCome from the largest vendor
4. DNeed the most staff to run