significant risk

A judgment-based classification within risk assessment processes that identifies evaluated risks whose combination of likelihood and potential harm to individuals, organizations, or systems crosses a threshold warranting priority attention, mandatory disclosure, or heightened controls. It is distinguished from ordinary risk by its magnitude or severity as assessed against an organization's or regulator's tolerance criteria — for example, under GDPR the equivalent trigger for a Data Protection Impact Assessment is "high risk" to natural persons, while Article 35(3) offers non-exhaustive examples of processing likely to result in high risk, such as systematic automated profiling producing legal or similarly significant effects on individuals. Across frameworks including ISO 27001, NIST 800-53, PCI DSS, and SOC 2, the phrase functions as an ordinary evaluative modifier applied contextually within risk assessment outputs — auditors examine how organizations identify risks, evaluate their likelihood and impact, and prioritize them based on business objectives — rather than as a term of art carrying a single, standardized cross-framework definition.

Advisory only. A term this product ships is defined by an authority document, not by a search result.