Threat Assessment: Questions a Good Assessment Should Answer

A practical framework for assessing threat actors, intent, capability, proximity, vulnerabilities and response priorities.

This guide provides general educational information. It does not replace legal advice, regulatory guidance or a case-specific assessment.

Define the protected asset

Define the protected asset should be examined in relation to the specific objective of threat assessment: questions a good assessment should answer. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.

A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.

Identify credible threat scenarios

Identify credible threat scenarios should be examined in relation to the specific objective of threat assessment: questions a good assessment should answer. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.

Assess intent and capability

Assess intent and capability should be examined in relation to the specific objective of threat assessment: questions a good assessment should answer. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.

Examine access and proximity

Examine access and proximity should be examined in relation to the specific objective of threat assessment: questions a good assessment should answer. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.

Evaluate vulnerabilities

Evaluate vulnerabilities should be examined in relation to the specific objective of threat assessment: questions a good assessment should answer. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.

Plan proportionate controls

Plan proportionate controls should be examined in relation to the specific objective of threat assessment: questions a good assessment should answer. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.

Core principle

Define the question, preserve relevant evidence, use proportionate methods and report limitations honestly.