27. How does the ITGI approach to information security governance address risk management? 1) It provides a specific process for risk identification only. 2) The ITGI approach does not address risk management. 3) It establishes a framework for identification and mitigation. 4) It leaves the job of risk management to the department