Risk strategy, processes and monitoring (BURM) (Level 3) Maintains documentation of risks, threats, vulnerabilities and mitigation actions.