Request for information (RFI), Research security requirements for contracts, Risk Management