which techniques represent risk mitigation?

In addition to encryption, which techniques represent risk mitigation?

A.
Two-factor authentication, role separation

B.
Two-factor authentication, privacy assessment

C.
Role separation, ISO 27002 assessment

D.
PCI compliance, hardened VMs