9.2 Identifying and assessing the threats