Assess Vulnerabilities

This assessment identifies all the components that may contribute to the actualization of the potential risk. These components are referred to as vulnerabilities and threats . In most cases, there will be several vulnerabilities and threats for each potential risk to the business.

Do not become wrapped up in the debate around the definitions of threats and vulnerabilities; at the end of the day it really does not matter as long as your company has a common understanding of these two terms. All too often debates over terminology drag processes down.