security risk
163509·updated Aug 30, 2026A measure of potential harm to an organization's information assets, operations, individuals, or mission — jointly determined by the likelihood that a threat will exploit a vulnerability and the severity of the resulting adverse impact. Per the NIST CSRC Glossary, drawing from NIST SP 800-160v1r1 and ISO Guide 73, it is formally defined as "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences." In information-system contexts, NIST elaborates this as risk arising through loss of confidentiality, integrity, or availability of information or systems, considering impacts to organizational operations and assets, individuals, other organizations, and the Nation. The field uses the expression operationally as an assessable and manageable quantity: risk is the potential for harm when a threat exploits a vulnerability, expressed as a function of threat source, threat event, vulnerability, predisposing conditions, and impact, and practitioners apply it at every tier — from individual systems to enterprise missions — to prioritize controls, justify countermeasures, and drive risk-treatment decisions.
Source
Users who pose a significant security risk include individuals for whom reliable evidence indicates either the intention to use authorized access to the system to cause harm or that adversaries will cause harm through them. Close coordination among mission and business owners, system administrators, human resource managers, and legal staffthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A measured characteristic of an entity — a person, system, process, or condition — expressing the degree to which it threatens adverse consequences to confidentiality, integrity, or availability of assets. It is formally defined as "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences" (NIST SP 800-160v1r1, drawing from ISO Guide 73). It is typically a function of two components: the adverse impacts that would arise if a threatening circumstance or event occurs, and the likelihood of that occurrence. In practice, the field applies the expression broadly — to technical configurations, personnel, third-party relationships, and operational conditions — and uses it as the object of management activities such as assessment, prioritization, treatment, and monitoring: risk that arises through the loss of confidentiality, integrity, or availability of information or information systems, considering impacts to organizational operations and assets, individuals, other organizations, and the Nation.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- security risks
- possessive
- security risk's
- pluralpossessive
- security risks'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A measure of potential harm to an organization's information assets, operations, individuals, or mission — jointly determined by the likelihood that a threat will exploit a vulnerability and the severity of the resulting adverse impact. Per the NIST CSRC Glossary, drawing from NIST SP 800-160v1r1 and ISO Guide 73, it is formally defined as "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences." In information-system contexts, NIST elaborates this as risk arising through loss of confidentiality, integrity, or availability of information or systems, considering impacts to organizational operations and assets, individuals, other organizations, and the Nation. The field uses the expression operationally as an assessable and manageable quantity: risk is the potential for harm when a threat exploits a vulnerability, expressed as a function of threat source, threat event, vulnerability, predisposing conditions, and impact, and practitioners apply it at every tier — from individual systems to enterprise missions — to prioritize controls, justify countermeasures, and drive risk-treatment decisions.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A measured characteristic of an entity — a person, system, process, or condition — expressing the degree to which it threatens adverse consequences to confidentiality, integrity, or availability of assets. It is formally defined as "the effect of uncertainty on objectives pertaining to asset loss and the associated consequences" (NIST SP 800-160v1r1, drawing from ISO Guide 73). It is typically a function of two components: the adverse impacts that would arise if a threatening circumstance or event occurs, and the likelihood of that occurrence. In practice, the field applies the expression broadly — to technical configurations, personnel, third-party relationships, and operational conditions — and uses it as the object of management activities such as assessment, prioritization, treatment, and monitoring: risk that arises through the loss of confidentiality, integrity, or availability of information or information systems, considering impacts to organizational operations and assets, individuals, other organizations, and the Nation.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.