How to respond to regulators with control: classify the request, govern the response, preserve evidence and manage remediation credibly.