Aligning an IT Security Assessment—Risks. Threats