3. COTS software installed on IT hosts
4. Vulnerabilities in the COTS software
5. Possible attackers, e.g., malicious insiders, external hackers, etc.
T-MAP defines a set of threat-relevant attributes for each of the above