health network risk mitigation plan prioritizing it risks