The mitigations must be tested by an independent group.

Steps have been taken to mitigate risks found during an assessment of custom software installed on one of the organization's servers computers. What step must be taken before the risk can be declared as mitigated? - The risks are considered mitigated once the proper controls have been put in place to deal with the risk - The developers of the custom software must sign off on the implemented mitigations - The owner of the server computer must sign off on the implemented mitigations - The mitigations must be tested by an independent group