We initially want to be able to identify and characterize the threats that arrive themselves against the systems that we manage what kinds of threats are out there and then we want to assess the vulnerability our critical assets and note that we specifically say critical assets, because you will not have enough budget to be able to mange risk across all the information systems in an organization. 