Cybersecurity risk is the chance and the impact of events that harm confidentiality, integrity, or availability of systems.
A risk statement names the event, what it would damage, how likely it seems now, and who accepts or reduces it.
How it works
Impact may be money, safety, legal duty, or loss of trust, and the same technical fault can score differently in two organizations.
Likelihood changes when exposure, attacker interest, and the quality of controls change, so last year's score is not a permanent fact.
Registers fail when they list vague fears without an owner or a treatment.
Treating a risk means reducing it, transferring part of the loss, avoiding the activity, or explicitly accepting what remains.
Concrete examples
- A hospital rates loss of access to care systems as a higher impact than loss of an internal newsletter.
- A retailer raises the likelihood of payment fraud after a season of abnormal order patterns.
- A board accepts a residual risk in writing after controls have reduced it as far as the budget allows.
Protective measures
- Write each cybersecurity risk as an event with an impact, a current likelihood, and a named owner.
- Reassess likelihood when exposure or controls change, rather than copying last year's score forward.
- Choose a treatment for every high risk, including an explicit acceptance when you decide not to reduce it further.
- Connect the register to real incidents so estimates are corrected by what has actually occurred.
Related articles
Turning a risk discussion into a shared set of outcomes is the role of What is a cybersecurity framework?.
Transferring part of the financial loss after an incident is explained in What is cyber insurance?.
Watching for the events a risk register worries about is part of the cycle in What is detection and response?.