When should information security controls be considered?
After the risk assessment
As part of the scoping meeting
At the kick-off meeting
During the risk assessment work