perform a cybersecurity risk assessment