RISK MANAGEMENT FOR CRITICAL SYSTEMS