Cybersecurity risk management process