White House mandated risk management reports show mapping of threat to capability to investment