A systematic process to identify assets, vulnerabilities, and the potential impact of security threats.