. . . . "Much of this information, particularly risk and threat analyses, has to be protected against unauthorized disclosure." .