recommended software measures based on risk