How is an information security risk assessment conducted? · ORA·tech