Analysis of threats and risks should include