What does an assessor need to understand before she or he can perform an assessment?
How active is each threat agent? How might a successful attack serve a particular threat agent’s goals?