I'm assuming this means they did a risk analysis, and have planned appropriate controls to mitigate the risks they found. A risk and a vulnerability are not th

I'm assuming this means they did a risk analysis, and have planned appropriate controls to mitigate the risks they found. A risk and a vulnerability are not the same thing.