thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Risk

The combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.

Definition

Risk is commonly expressed as a function of threat, vulnerability, and impact (or likelihood and consequence). ISO 31000 defines it as the effect of uncertainty on objectives, which can be positive or negative. Security risk exists only where a threat can act on a vulnerability of an asset with value.

Example

An unpatched internet-facing server (vulnerability) targeted by ransomware groups (threat) holding customer data (asset) represents high risk.

Exam tip

Be precise: a vulnerability alone is not a risk; risk requires a threat and an impact.

Don't confuse it with

Related terms