What is a step for constructing a threat model for a project when using practical risk analysis?
A) Identify potential threats
B) Assign severity ratings to identified threats
C) Define the system architecture
D) Prioritize vulnerabilities based on business impact
