NIST Many NIST publications define risk in IT context in different publications: FISMApedia term provide a list. Between them: According to NIST SP 800-30: Risk is a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization. From NIST FIPS 200 Risk – The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring. NIST SP 800-30 defines: IT-related risk The net mission impact considering: the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and the resulting impact if this should occur. IT-related risks arise from legal liability or mission loss due to: Unauthorized (malicious or accidental) disclosure, modification, or destruction of information Unintentional errors and omissions IT disruptions due to natural or man-made disasters Failure to exercise due care and diligence in the implementation and operation of the IT system. Risk management insight IT risk is the probable frequency and probable magnitude of future loss. ISACA ISACA published the Risk IT Framework in order to provide an end-to-end, comprehensive view of all risks related to the use of IT. There, IT risk is defined as: The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise According to Risk IT, IT risk has a broader meaning: it encompasses not just only the negative impact of operations and service delivery which can bring destruction or reduction of the value of the organization, but also the benefit\value enabling risk associated to missing opportunities to use technology to enable or enhance business or the IT project management for aspects like overspending or late delivery with adverse business impact Measuring IT risk You can't effectively and consistently manage what you can't measure, and you can't measure what you haven't defined. Measuring IT risk (or cyber risk) can occur at many levels. At a business level, the risks are managed categorically. Front line IT departments and NOC's tend to measure more discrete, individual risks. Managing the nexus between them is a key role for modern CISO's. When measuring risk of any kind, selecting the correct equation for a given threat, asset, and available data is an