If an engineering server’s risk of being hacked is assigned a risk level of very high, which assessment strategy is being used?