What level of risk is the risk categorization prior to determining and implementing mitigating actions?