Before you create business units, you need to categorize your mitigating controls. You assign each mitigating control to a specific business unit.

You can also use business units to limit controls available to the business units specified in the role definition.