Matching Possible Mitigations to Cyber Threats: A Document-Driven Decision Support Systems Approach