Can you explain your experience in conducting SoD risk analysis and the tools you utilized for mitigation controls?