security risk

A magnitude of potential harm — characterized jointly by the likelihood of a threat event and the severity of its adverse impact — arising from the loss of confidentiality, integrity, or availability of information or systems, and the associated organizational, operational, or individual consequences. Grounded in ISO Guide 73 and carried into NIST SP 800-160, the core formulation is "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences." More operationally, NIST defines it as "a measure of the extent to which an entity is threatened by a potential circumstance or event," treated as a function of adverse impacts and the likelihood of occurrence. Across standards and regulatory practice, the expression is used as the object of assessment, acceptance, treatment, and monitoring: analysts quantify or qualify it, management decides how much to tolerate, and controls are selected to reduce it — whether the subject at risk is a person, a technology asset, a business process, or an entire organization. NIST SP 800-53 and SP 800-37 define the system-specific variant as "risk that arises through the loss of confidentiality, integrity, or availabilit

Advisory only. A term this product ships is defined by an authority document, not by a search result.