What staff does the organization have? Are their volunteers, maintenance, cleaning, security, or other non-critical staff who have access to the office? Who does the organization serve? Does the organization have any partners? Who are the organizations beneficiaries? VULNERABILITY ANALYSIS Understand the organisation’s exposure to threats, points of weakness and the ways in which the organisation may be affected. Vulnerability Definition: A attribute or feature that makes an entity, asset, system, or network susceptible to a given threat. Example: This can include poorly built or unmaintained hardware, software, or offices as well as missing, ignored, or poor policies or practices around security. THREAT ANALYSIS Threat analysis is the process of identifying possible attackers and gathering background information about the capability of those attackers to threaten the organization. The basis of this information is a potential threats history of carrying out specific threats, their capability to carry out those threats currently, and proof that the threat hasintent to leverage resources against the target. Threat Definition: A threat is a possible attack or occurrence that has the potential to harm life, information, operations, the environment, and/or property. Example: Threats can range from fire, or flood, to targeted malware, physical harassment, or phishing attacks. Threat History Definition: What types of threats has the attacker used historically. And, what types of actors have been targeted by those threats. Example: What history of attacks does the threat actor have? What techniques have they used? Have they targeted vulnerabilities that the organization currently has? Have they targeted similar organizations? What is known about the types of threats used by an threat actor to attack similar Page 8 of 240