This part of the OSSTMM section deals with what needs to be protected and how much the attack surface is exposed. This can be measured by creating an RAV (an unbiased factual description of the attack surface).
