To do this, we must place careful consideration on the foundation of a security program: Threat Vulnerability and Risk Assessments (TVRA).