security risk management is an ongoing effort