Technology risk management from a regulatory perspective