Involves identifying potential threats and vulnerabilities to a system, and assessing their potential impact on the system.