Review and extension of a risk analysis for the introduction of O365