How did you gather your intelligence? Who is the threat? What are the risks to the organization? How may the organization be impacted by regulations or laws because of these risks? (I understand you are not a lawyer; however you need to know your constraints and legal requirements) How do you prioritize the threats since resources are finite? What do you recommend as a decision to leadership? What is the rationale for your decision? What will your decision cost in terms of money, time, resources, etc