Controls vary, but common ones include access restrictions, encryption, network segmentation, regular patching, and employee awareness training. The right mix depends on what the assessment uncovers.