AssetSomething of value, including a service, process, information, system, reputation, relationship or capability.
Business impactThe operational, financial, customer, legal, safety, strategic or reputational consequence of a scenario.
Control ownerThe person accountable for operating or maintaining a safeguard.
Cyber riskThe possibility that digital dependence, events or conditions could affect an organizational objective or obligation.
CybersecurityPractices and safeguards used to protect systems, identities, networks, software and data.
DependencyA service, supplier, system, person, integration or resource required for another activity to function.
Inherent riskExposure before considering the effect of selected safeguards.
LikelihoodA reasoned view of how plausible a scenario is over a defined period and context.
Residual riskExposure remaining after safeguards and treatment are considered.
Risk acceptanceAn authorized decision to carry defined residual exposure for a period and under stated conditions.
Risk appetiteBroad guidance about the amount and type of risk an organization is willing to pursue or retain.
Risk ownerThe accountable leader who owns the consequence and can decide or escalate treatment.
Risk registerA structured record of material risk scenarios, owners, assessment, treatment, status and review.
Risk toleranceA more usable boundary or threshold that guides when exposure must be reduced, escalated or approved.
ScenarioA plausible event path connecting conditions and an initiating event to consequences.
SafeguardA control, procedure, contract, design choice, recovery measure or other action that changes exposure.
Third partyAn external vendor, contractor, processor, platform, service provider or partner.
TreatmentThe decision to reduce, accept, transfer, avoid or monitor risk.
UncertaintyWhat is not known or not strongly supported by evidence in the assessment.
Operational resilienceThe ability to continue, adapt and recover important services through disruption.