Information security risk is associated with the potential that the vulnerabilities of an information asset may be exploited by threats

Information security risk cannot be accepted without being treated or during the process of risk treatment

Information security risk can be expressed as the effect of uncertainty on information security objectives