The correct answer to the question "What is any device or process that reduces risk?" is Security control.
While access control lists, firewalls, and mantraps are specific types of security controls, the term "security control" is a broader category that encompasses any measures taken to mitigate risks.