Term:Risk

CNSSI 4009

Risk - Possibility that a particular threat will adversely impact an IS by exploiting a particular vulnerability.

DoDI 8100.03

Risk - A combination of the likelihood that a threat will occur, the likelihood that a threat occurrence will result in an adverse impact, and the severity of the resulting impact. E2.1.31.

DoDI 8551.01

Risk - A combination of the likelihood that a threat will occur, the likelihood that a threat occurrence will result in an adverse impact, and the severity of the resulting impact ( reference (f)). E2.1.15.

DSS Glossary

Risk - Measure of the potential degree to which protected information is subject to loss through adversary exploitation.

GAO-09-232G

Risk - The level of impact on entity operations (including mission, functions, image, or reputation), entity assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring.

NIST FIPS 200

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring.

NIST IR 7298

Risk - The level of impact on agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. SOURCE: SP 800-53; FIPS 200

NIST IR 7328 Draft

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the nation resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [FIPS 200, Adapted]

NIST SP 800-16

Risk - the probability that a particular security threat will exploit a system vulnerability.

NIST SP 800-18r1

Risk - The level of impact on agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [NIST SP 800-30]

NIST SP 800-26

Risk - Risk is the possibility of harm or loss to any software, information, hardware, administrative, physical, communications, or personnel resource within an automated information system or activity.

NIST SP 800-27rA

Risk - Within this document, synonymous with "IT-related risk."

NIST SP 800-28v2

Risk - A measure of the likelihood and the consequence of events or acts that could cause a system compromise, including the unauthorized disclosure, destruction, removal, modification, or interruption of system assets.

NIST SP 800-30

Risk - Within this document, synonymous with IT-Related Risk.

NIST SP 800-32

Risk - An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result.

NIST SP 800-33

Risk - Within this document, synonymous with "IT-related risk."

NIST SP 800-37r1 Draft

Risk - A measure of the extent to which an entity is threatened by a potential circumstance or event and typically a function of the likelihood of the circumstance or event occurring and of the resulting adverse impacts. [NIST SP 800-30, Revision 1]

NIST SP 800-37

Risk - The level of impact on agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [NIST SP 800-3730]

NIST SP 800-39 Draft 2

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation resulting from the operation or use of an information system given the potential impact of a threat and the likelihood of that threat occurring. [FIPS 200 Adapted]

NIST SP 800-40

Risk - The probability that a particular threat will exploit a particular vulnerability.

NIST SP 800-47

Risk - The net mission impact considering the probability that a particular threat will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and the resulting impact if this should occur.

NIST SP 800-53A

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [FIPS 200, Adapted]

NIST SP 800-53r1

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring.

NIST SP 800-53r2

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [FIPS 200]

NIST SP 800-53r3

Risk - A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.

Information system-related security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. [FIPS 200, Adapted]

NIST SP 800-60r1V1

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [FIPS 200, Adapted]

NIST SP 800-60r1V2

Risk - The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. [FIPS 200, Adapted]

NIST SP 800-61r1

Risk - The probability that one or more adverse events will occur.

NIST SP 800-61

Risk - The probability that one or more adverse events will occur.

NIST SP 800-66

Risk - The level of impact on agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the probability of that threat occurring. [NIST SP 800-6630]

NIST SP 800-79-1

Risk - The level of potential impact on an organization operations (including mission, functions, image, or reputation), organization assets, or individuals of a threat or a given likelihood of that threat occurring.

NIST SP 800-82 Final Draft

Risk - The level of impact on agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system, given the potential impact of a threat and the likelihood of that threat occurring.[NIST SP 800-30, Risk Management Guide for Information Technology Systems, July 2002.]

NSTISSI 1000

Risk - A combination of the likelihood that a threat will occur, the likelihood that a threat occurrence will result in an adverse impact, and the severity of the resulting impact.