Also, expanding on the threat model is of course understanding why would one be targeted, what is the attacker's goal, and how would they carry out the attack. This will help the defender build layers of proactive and reactive controls specific to the threats and targets identified.
