Researching potential threats, vulnerabilities, and control techniques and communicating this information to others in the organization.

Does it follow that "Potential threats have to be researched."?
Pick from:
- yes;
- it is not possible to tell;
- no;
yes