evaluate and mitigate cybersecurity risks