Risk is the combination of vulnerabilities and applicable threats that manifest themselves into the likelihood of something bad happening and the impact if it did. If there is no vulnerability (or weakness) in a control, there is no risk. If there is a vulnerability in a control without an applicable threat, there is also no risk. The FISASCORE™ represents the analysis of hundreds of controls, thousands of vulnerabilities and thousands of threats; resulting in likelihoods and impacts of bad events.
processing
