How does an organization's patch management strategy integrate with its overall risk management framework, particularly in the context of identifying, prioritizing, and mitigating vulnerabilities across heterogeneous IT environments?