evalulate organizations' vulnerabilties for threats, both internal and external. such threats could include sabotage, espionage, collusion, bribes, and snooping as typically internal and fire, water damage, burglars, internet attackers, competition, and natural disasters such as floods, tornadoes, and hurricanes as typically external.