Normal Threat modeling will be something we need to do repeatedly. We should have an up-to-date architectural overview of the system with ingress/egress points, who has access to different areas, what are the perimeters, and what communication paths are encrypted, etc.
There is already some prior effort that can be updated/built upon.