The right methodology for your system depends on the types of threats you are trying to model. You’ll want to consider the following:
The types of threats and risks commonly faced by other companies in the industry
The size and competence of your staff
The available resources, financial and otherwise
Your tolerance for risk