Security risk management and duty of care during COVID-19