A threat and vulnerability assessment is a process that identifies and evaluates the potential sources and impacts of risk events on an organization’s assets, processes, and objectives. It also estimates the probability of occurrence and the severity of consequences for each risk event. A threat and vulnerability assessment is the best way to quantify the likelihood of risk materialization, as it provides a numerical or qualitative measure of the risk exposure and the level of uncertainty associated with the risk scenarios. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.2, p. 68-69