https://securitycourses.com/threat-analysis/easy-to-follow-sp800-37-guideline-for-smes/