Category network security risk assessment steps