Domain 3: Selection and Approval of Framework Security and Privacy Controls