CISA: Certified Information Systems Auditor

Threat and vulnerability analysis identifies potential threat events and the weaknesses they could exploit, enabling proactive identification of risk scenarios that may affect IT processes before incidents occur. Historical metrics, incident reports, self-assessments, and policy reviews are useful inputs, but are less direct methods for discovering previously unrecognized risks.