What is the definition of Risk in Information Security?

The most widely accepted definition of risk in information security and enterprise risk management is the product of the probability of a threat event occurring and the resulting impact or consequence of that event. The formula Risk = Probability x Impact provides a foundational model for measuring and comparing different risks. "Probability" (or likelihood) represents the chance of a threat exploiting a vulnerability, while "Impact" represents the magnitude of the harm (financial, reputational, operational) that would result.

B. This is incorrect. A threat is an actor or event; it cannot be multiplied. Risk involves the probability of that threat succeeding.
C. This is too narrow. Impact encompasses more than just financial loss, including reputational damage, operational disruption, and legal penalties.
D. This is conceptually incorrect. A threat is a source of potential harm, not a numerical value to be used in a multiplicative formula.

- National Institute of Standards and Technology (NIST). (2020). NISTIR 8286: Integrating Cybersecurity and Enterprise Risk Management (ERM). Section 2.1 defines risk as a function of "the adverse impacts that would arise if the circumstance or event occurs; and the likelihood of occurrence."

- International Organization for Standardization. (2018). ISO 31000:2018 - Risk management — Guidelines. This standard defines risk as the "effect of uncertainty on objectives," which is practically assessed by analyzing the likelihood and consequences (impact) of potential events.