ORGANIZATIONAL ASSETS include data, people, process, and technology systems. These assets face real threats every day and sometimes are unavoidable. To manage the risks that these threats pose, which assets need to be protected and the source of these threats must be identified. Additionally, what vulnerabilities are present in the assets that could be exploited by the threats is important to know. Threats usually exploit vulnerabilities to harm an asset. An understanding of the relationship between threat and vulnerability (also known as the threat/vulnerability pair) is important to mitigate risks.

The U.S. federal government has done much in the information security space, including developing frameworks to help understand and manage risks regarding organizational assets. One example of a framework is the Risk Management Framework (RMF) from the National Institute of Standards and Technology (NIST). The NIST RMF 800 special publications series provides a set of policies and standards that cover the life cycle of risk activities. These publications are freely available on the NIST.gov website. Additionally, the Department of Homeland Security (DHS) oversees several other initiatives related to information technology (IT) security.