True or false? risk assessment should cover personnel, as well as technical support such as firewalls, secure operating systems and networks, and antivirus protection.