The method focuses on threats and vulnerabilities associated with the processes and controls under the management of the IT Security Department and involve tackling information security based on three pillars: confidentiality, integrity and availability.