Identification should include differentiating between a threat and a vulnerability, as well as
email usage
insider threats
employee errors
poor management
poor policy creation
unused accounts
poor password selection.