Information Security Handbook

Identifying your organizations threats

When conducting a qualitative risk assessment, the first thing you will do is develop a list of threats that your organization is likely to encounter. You will want to develop a list that at a minimum includes the following:

• Threat: Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the nation through an information system through unauthorized access, destruction, disclosure, or modification of information, and/or denial of service
• Threat source: The intent and method targeted at the intentional exploitation of a vulnerability, or a situation and method ...