. . . "The risk assessment should consider technology that handles communication, such as e-mail and voice, in their risk ranking." . .