Analysis should include threats from
employees
natural disasters
malware
common vulnerability and exposures (CVE)
common vulnerability scoring system (CVSS)
unknown hackers.