Threat events are accidental or intentional exploitation of vulnerabilities. Breaches occur due to Information System incorrect configuration issues. Threat Agents include hostile employees, untrained employees, and foreign governments. Risk includes appetite and tolerance; acceptable risk and deviations from that risk.