An evaluation of the possibility of a threat or vulnerability existing. An assessment must be performed before any other actions can be decided (e.g, how much to spend on security terms of dollars and manpower.