What it means
Risk connects a possible event to a consequence that matters. A useful statement says what could happen, which weakness or condition makes it possible, and who would be harmed. The assessment then considers likelihood, impact, existing controls, and uncertainty. This makes a risk actionable instead of a vague concern such as “hackers.”
Risk exists before anyone writes it down. A risk register is the record used to make decisions about it. Different teams may use qualitative categories or quantitative estimates, but the assumptions still need to be visible. The purpose is to choose and track a response, not merely produce a score.
The idea at a glance / Risk
One scenario. Connected questions.
A stolen supervisor session could expose another store’s payment records. Separate the permission evidence, likelihood, harm, and unfinished response.
Fictional MetroMart R61, 25 September 2026 at 09:00 UTC. SV-4’s job covers Store A. T61 uses synthetic records; the assessment horizon is seven days.
READ THE PICTURE
Read the evidence and limits
T61 returned Store B test records to Store A’s account. That demonstrates a permission weakness. Theft likelihood and real harm remain unresolved; Morgan’s store restriction is proposed, and the decision is pending.
Keep in mindThis is a possible disclosure scenario, not a reported breach or a scored assessment. No likelihood percentage, financial total, or risk-acceptance decision is established.
Read the complete example
- Read the evidence and limits. T61 returned Store B test records to Store A’s account. That demonstrates a permission weakness. Theft likelihood and real harm remain unresolved; Morgan’s store restriction is proposed, and the decision is pending. At 09:00 UTC on 25 September 2026, MetroMart records possible disclosure of Store B payment reconciliation data using a stolen valid session for Store A supervisor SV-4, before 09:00 UTC on 2 October. The weakness is a broad all-store export permission on the export API. In controlled test T61 at 08:45, an authorized tester used SV-4’s ordinary valid session and received synthetic Store B records. This demonstrates one permission path under test conditions; the tester did not steal an account and the result is not evidence of an attacker or real disclosure. SV-4’s legitimate job needs only Store A records. The assessment separates how plausible session theft and resulting misuse are from the harm if disclosure occurs. Potential harms include exposing transaction details beyond the intended store audience and the effort to investigate and respond. Theft frequency, applicable real-record volume, and the magnitude of harm are unresolved. No numeric probability, defined qualitative rating, monetary estimate, or combined score is assigned. Morgan owns the decision and proposes a store-scoped export restriction, with review on 28 September. At this snapshot, that proposal has not been implemented and the risk decision remains pending. The residual-risk figure deliberately uses a later, tested configuration; its result must not be credited here.
This is a possible disclosure scenario, not a reported breach or a scored assessment. No likelihood percentage, financial total, or risk-acceptance decision is established.
Diagram references: NIST SP 800-30 Rev. 1 - risk factors, assumptions and assessment limits
AN ILLUSTRATIVE SCENARIO
A retailer payment export
A retailer lets every store supervisor download all stores' payment reconciliation records. The concern is that a stolen supervisor account could expose information beyond that person's job. The team records the broad permission as a weakness, account theft as a possible event, and the resulting disclosure and response effort as consequences. It proposes limiting exports by store, names an owner, and sets a review date. Management can then compare the remaining exposure with the cost and disruption of changing access.
Put it to work
- Write one clear scenario connecting an asset, an unwanted event, relevant weaknesses, and a concrete consequence.
- Assess likelihood and impact using available evidence; document operating controls, assumptions, and important information you still lack.
- Assign an accountable owner to choose a response, track actions and deadlines, and revisit the assessment after meaningful changes.
How to check your work
Inspect one risk record. It should support a real decision, identify who owns that decision, and show when evidence or a changed condition will trigger another review.
Connect the ideas
- Threat
A person, process, or event that might cause a loss to an asset.
- Vulnerability
A weakness in a system, process, or person that makes a loss easier to cause.
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
- Residual risk
The risk that remains after implemented safeguards, including uncertainty in its assessment.