negative risk

{
  "id": "MLC-T-CYB-002799",
  "term": "negative risk",
  "field": "Cybersecurity",
  "definition": "1. Any circumstance or event with the potential to adversely impact organizational operations and assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, or modification of information, and/or denial of service.\n\n2. Potential cause of unacceptable asset loss and the undesirable consequences or impact of such a loss.\n\n3. Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, or denial of service.\n\n4. Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service; the potential for a threat source to successfully exploit a particular information system vulnerability.\n\n5. Any circumstance or event with the potential to adversely impact agency operations (including safety, mission, functions, image, or reputation), agency assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.\n\n6. Any circumstance or event with the potential to adversely impact organizational operations.\n\n7. Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, or modification of information, and/or denial of service.\n\n8. Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.\n\n9. Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.\n\n10. The potential for a “threat source” (defined below) to exploit (intentional) or trigger (accidental) a specific vulnerability.\n\n11. potential cause of an unwanted incident, which may result in harm to a system or organization\n\n12. Any circumstance or event with the potential to harm an information system through unauthorized access, destruction, disclosure, modification of data, and/or denial of service. Threats arise from human actions and natural events.\n\n13. An event or condition that has the potential for causing asset loss and the undesirable consequences or impact from such loss.\nNote: The specific causes of asset loss, and for which the consequences of asset loss are assessed, can arise from a variety of conditions and events related to adversity, typically referred to as disruptions, hazards, or threats. Regardless of the specific term used, the basis of asset loss constitutes all forms of intentional, unintentional, accidental, incidental, misuse, abuse, error, weakness, defect, fault, and/or failure events and associated conditions.",
  "abbreviation": "threat",
  "references": [
    "NIST SP 1800-30B from NIST SP 800-30 Rev. 1 (adapted)",
    "NIST SP 800-160v1r1",
    "NIST IR 8401 from NIST SP 800-53 Rev. 5 (adapted); NIST IR 8323r1 from NIST SP 800-53 Rev. 5; NIST IR 8441 from NIST SP 800-53 Rev. 5",
    "NIST IR 8270",
    "NIST SP 800-82r3 from FIPS 200 (adapted)",
    "NIST SP 800-221",
    "NIST SP 800-61r3 from NIST SP 800-30 Rev. 1",
    "CNSSI 4009-2015 from NIST SP 800-30 Rev. 1",
    "NIST SP 800-128 from NIST SP 800-30; NIST SP 800-171 Rev. 2 [Superseded] from NIST SP 800-30; NIST SP 800-37 Rev. 2 from NIST SP 800-30 Rev. 1; NIST SP 800-53 Rev. 5 from NIST SP 800-30 Rev. 1; NIST SP 800-172 [Superseded] from NIST SP 800-30 Rev. 1; NIST SP 800-171 Rev. 1 [Superseded] from CNSSI 4009 (Adapted); NIST SP 800-53A Rev. 5 from NIST SP 800-30 Rev. 1; NIST SP 800-172A [Superseded] from NIST SP 800-30 Rev. 1; NIST SP 800-161r1-upd1 [11/1/2024 errata update] from NIST SP 800-53 Rev. 5; NIST SP 800-171r3 from NIST SP 800-30 Rev. 1; NIST SP 800-172r3 from 44 U.S.C., Sec. 3552",
    "NIST SP 800-33 [Withdrawn]",
    "NISTIR 8053 from ISO/IEC 27000:2014",
    "NIST SP 800-27 Rev. A [Withdrawn]",
    "NIST SP 800-160 Vol. 1",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/negative-risk/"
}