The rapid development of information technologies has led to an increased demand for secure information systems, highlighting the importance of analyzing and assessing threats to information security. This paper presents a structured algorithm for threat assessment within organizations, encompassing asset identification, vulnerability analysis, protection level evaluation, damage estimation, and risk probability calculation. It proposes a comprehensive model linking threats, vulnerabilities, implementation methods, and potential consequences. The approach integrates both qualitative and quantitative assessments and utilizes coefficients to measure the severity, urgency, and likelihood of threats. Additionally, the algorithm includes risk classification, the development of effective countermeasures, and the preparation of analytical reports. Threat sources are categorized as anthropogenic, technogenic, or natural, with a focus on internal and external origins. The use of ISO 19011 auditing standards ensures systematic evaluation and continual improvement. This algorithm supports organizations in enhancing their information security posture by identifying weak points and implementing timely, effective mitigation strategies.