The magnitude of the importance of a threat or misbehaving asset (very low risk to very high risk). It is a calculation based on likelihood, impact and controls.