Internal weaknesses arise through lack of awareness of potential threats and inadequate policy and
process to deal with these threats. An example of this is allowing employees to plug non-agency USB
devices (USBs) or other devices into internal networks.