Risk can be defined as the potential for loss of or damage to an asset. It takes into account the threats or hazards that potentially impact the asset, consequences, and the vulnerability of the asset to the threat or hazard.

Ratings can be assigned to these three components of risk (Low, Medium, and High) to provide a risk rating.

In general terms, consequences can include the replacement time and cost for infrastructure and equipment. It can include lost profit to a business or lost capability to a mission that resulted in greater damage and loss to that asset and other assets.