In order to assess the risks that may threaten the security, confidentiality, or integrity of member information or member information systems, the credit union shall:

• Identify all reasonably foreseeable internal as well as external threats that can result in unauthorized disclosure, misuse, alteration, or destruction of member information or member information systems.
  
  
• Determine the likelihood as well as potential damage of the internal and external threats.
  
  
• Determine the sufficiency of the credit union’s policies, procedures and member information systems to control the identified risks.