A model of mitigating risk for IT organisations | IEEE Conference Publication | IEEE Xplore