Understand what data is valuable to which malicious actors. Creating profiles for groups such as hostile nation states, organized criminals, activists, and amateur hackers helps understand their goals and capabilities.
Controls exist to mitigate risk. Create metrics and indicators for critical controls to understand whether they are functioning effectively. Without understanding the effectiveness of controls, it is difficult to know if risks are being managed.