A company is identifying risks associated with a new cloud-based CRM. Which of the following is the MOST effective method for identifying potential threats?