Before proceeding, you should review NIST SP 800-30 R1: Guide for Conducting Risk Assessments. https://doi.org/10.6028/NIST.SP.800-30r1 Pay special attention to Appendix D: “Threat Sources: Taxonomy of Threats Sources Capable of Initiating Threat Events” and Appendix H: “Impact: Effects of Threat Events on Organizations, Individuals, and the Nation.”