Information Security Risk Management

Anything of value to the organization that requires protection, such as data, systems, people, facilities, or reputation.

A potential cause of an unwanted incident that may result in harm to a system or organization; the agent or event that can exploit a vulnerability.

A weakness in an asset, control, or process that can be exploited by one or more threats to cause harm.

Risk arises only when a threat has the capability to exploit a corresponding vulnerability affecting an asset; without one or the other, no risk is realized.

The probability or frequency that a given threat will exploit a vulnerability and result in an adverse event.

The magnitude of harm or consequence to the organization if a risk event is realized, often expressed financially or operationally.