Requirements for using Threat Risk Levels