Explain how a weakness in a system can become a documented cyber risk, and distinguish the roles of threat, vulnerability, impact, and control.

### Why this is right A risk assessment connects a possible source of harm to a weakness and to consequences for an asset. The organization estimates how likely the event is and how serious its effects would be, then evaluates whether controls reduce the exposure. ### The concept A threat might be a cybercriminal seeking account information. A vulnerability might be a weak password that gives that actor a way to gain access. Impact describes the harm if the threat succeeds, such as loss of access to data or damage to operations. A control, such as enforcing a password policy, is applied to reduce likelihood or limit harm. The risk left after controls is residual risk, which should be assessed rather than assumed to be zero. ### What a good answer covers - Defines threat as a possible source of harm. - Defines vulnerability as an exploitable weakness. - Explains that likelihood and impact inform the risk rating. - Describes controls and the reassessment of residual risk. ### Terms - **Impact**: The severity of harm if a threat event occurs. - **Likelihood**: The estimated chance that a threat event will occur. ### Remember A weakness becomes a risk concern when a threat could exploit it and cause an impact.