Might sound a bit of a silly question. I see people talking about threat models, and privacy guides which say things like “if this is part of your threat model, do X Y Z”. I’m just not sure if it’s a general “this is what I want to protect myself against” or if there’s more to it.
Yes that’s the gist of it. You can even visualize it by using tables or charts. The goal is to identify the assets you want to protect and what threats you are protecting them against.