first pass at cot version

started combining the old risk talk with the nist talk for cot