use an example to explain risk exposure related to information technology. how can information security policies mitigate risk exposure