Description should include a definition of threat modeling and the concepts that

• the attack surface includes all areas of an organization that can be penetrated or threatened
• organizations may have differing levels of vulnerability due to their integration of technology.

For example, an organization that processes payments via an Internet site increases the vulnerability of threats against the payment processing system from attackers anywhere in the world. An organization that does not collect information via the Internet would have much less vulnerability from that attack avenue.