The initial step in the PR&PP assessment is the definition of the challenges, i. e., of the threats considered within the scope of the evaluation. To be comprehensive, a full suite of potential threats, referred to as the reference threat set (RTS), must be recognized and evaluated. If a subset of the threat space is to be the focus of a specific case study, the subset must be explicitly defined. Threats evolve over time; therefore system designs must be based on reasonable assumptions about the spectrum of threats to which facilities and materials in the system could be subjected over their full life cycles. The level of detail in threat definition must be appropriate to the level of information available regarding design and deployment.

The definition of a specific PR&PP threat requires information both about the actor and the actor’s strategy. Here, actor is defined by the following factors:

• type (e. g., host state, sub-national, etc.);

• capabilities;

• objectives;

• strategies.