1. Choose a real organization (for example hospital, military organization, bank, online business) you are familiar with or interested in and perform an assessment of the following.
2. What are their information technology assets?
3. What risks do the assets face?
4. What threat agents are expected?
5. Make a profile of an insider in this organization, explaining what attacks they could carry out
6. Finally, develop a set of requirements and controls you argue will address the risks