Every organisation will have a set of threats which they are most concerned about. This should be tailored for the organisation.