security risk
163509·updated Aug 30, 2026A measure of potential harm to an organization's information assets, operations, individuals, or mission — jointly determined by the likelihood that a threat will exploit a vulnerability and the severity of the resulting adverse impact. Per the NIST CSRC Glossary, drawing from NIST SP 800-160v1r1 and ISO Guide 73, it is formally defined as "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences." In information-system contexts, NIST elaborates this as risk arising through loss of confidentiality, integrity, or availability of information or systems, considering impacts to organizational operations and assets, individuals, other organizations, and the Nation. The field uses the expression operationally as an assessable and manageable quantity: risk is the potential for harm when a threat exploits a vulnerability, expressed as a function of threat source, threat event, vulnerability, predisposing conditions, and impact, and practitioners apply it at every tier — from individual systems to enterprise missions — to prioritize controls, justify countermeasures, and drive risk-treatment decisions.
Source
Users who pose a significant security risk include individuals for whom reliable evidence indicates either the intention to use authorized access to the system to cause harm or that adversaries will cause harm through them. Close coordination among mission and business owners, system administrators, human resource managers, and legal staffthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- security risk - Glossary | CSRC
- information system-related security risks - Glossary | CSRC
- How to Implement NIST SP 800-30, Complete Guide for 2025 | Isora GRC
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A magnitude of potential harm — characterized jointly by the likelihood of a threat event and the severity of its adverse impact — arising from the loss of confidentiality, integrity, or availability of information or systems, and the associated organizational, operational, or individual consequences. Grounded in ISO Guide 73 and carried into NIST SP 800-160, the core formulation is "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences." More operationally, NIST defines it as "a measure of the extent to which an entity is threatened by a potential circumstance or event," treated as a function of adverse impacts and the likelihood of occurrence. Across standards and regulatory practice, the expression is used as the object of assessment, acceptance, treatment, and monitoring: analysts quantify or qualify it, management decides how much to tolerate, and controls are selected to reduce it — whether the subject at risk is a person, a technology asset, a business process, or an entire organization. NIST SP 800-53 and SP 800-37 define the system-specific variant as "risk that arises through the loss of confidentiality, integrity, or availabilit
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- security risks
- possessive
- security risk's
- pluralpossessive
- security risks'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A measure of potential harm to an organization's information assets, operations, individuals, or mission — jointly determined by the likelihood that a threat will exploit a vulnerability and the severity of the resulting adverse impact. Per the NIST CSRC Glossary, drawing from NIST SP 800-160v1r1 and ISO Guide 73, it is formally defined as "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences." In information-system contexts, NIST elaborates this as risk arising through loss of confidentiality, integrity, or availability of information or systems, considering impacts to organizational operations and assets, individuals, other organizations, and the Nation. The field uses the expression operationally as an assessable and manageable quantity: risk is the potential for harm when a threat exploits a vulnerability, expressed as a function of threat source, threat event, vulnerability, predisposing conditions, and impact, and practitioners apply it at every tier — from individual systems to enterprise missions — to prioritize controls, justify countermeasures, and drive risk-treatment decisions.DR-088 backfill from the noun definition column