A threat assessment helps a company classify its assets and then looks at the vulnerabilities of that asset. It will look at all of the threats the company may face, the probably of the threat happening, and the potential loss should the threat be successful:

• Environmental threat: This threat is based on environmental factors, for example the likelihood of a flood, hurricane, or tornado. If you live in Florida there is a peak season for hurricanes from mid—August to October, whereas if you live in Scotland, the last time they had a minor hurricane was in 1968. Florida has a high risk of having a hurricane whereas Scotland would be extremely low risk.
• Man—made threat: This is a human threat—it could be a malicious insider attack where an employee deliberately deletes data or could just be an accidental deletion by an incompetent member of staff.

• Internal threat: This could be the disgruntled employee who is called the malicious insider threat—they could deliberately sabotage the data and IT systems. This malicious insider threat is the hardest to discover as they can hide their tracks or use someone else's credentials.
• External threat: This could be a hacker or could be an threat such as a flood, hurricane, or tornado.