Yes, and it is separated into the “Threat is likely to be less serious” and “Threat is likely to be more serious” sections, following the CSTAG model, which you helps evaluate and attempt to resolve the threat.