FFIEC IT Examination Handbook IS-III.A: III.A Threat Identification and Assessment (Information Security)

Management identifies and assesses threats, uses the knowledge to drive risk assessment and response and designs policies so that immediate and consequential threats are dealt with expeditiously, with procedures for obtaining, monitoring, assessing and responding to evolving threat and vulnerability information from government, information-sharing organisations, industry, the institution's own data and third parties, covering hostile attacks, human error, structural failures and disasters.