When creating a mitigation plan, management should rank which risks to address first based on severity, addressing the mitigation of critical risks first. A timeline should be created for the mitigation plan that includes other projects outside of risk mitigation projects that are a priority and will reduce the amount of effort that can be directed at risk mitigation activities.