An evaluation of the threats to information assets, including a determination of their likelihood of occurrence and potential impact of an attack.