As I mentioned before, one of CSIS's roles is providing advice to government on all the economic security considerations, so that government can make the best-informed decision possible. On mitigating risk, you get down to the level where you have residual risk and decide whether you can accept it or need to further mitigate. This is a decision more for government decision-makers.
What the service does is investigate, provide advice on the threat and the activity, and allow government to use that information to make the best decision possible about the way forward.
