""2.2 How do Organizations Assess the Risk of Acquired IT Products