Are there any methodology for malware in case of threat assessment?

Question

Malware is a threat in security assessment. Are there any criteria to assess malware in case of threat assessment?