The potential that threats will exploit vulnerabilities of an information asset and cause harm to an organization

Weakness of an asset or control that can be exploited by one or a group of threats

Potential cause of an unwanted incident related to information security that can cause harm to an organization