SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-risk-likelihood-impact

In NIST SP 800-30, risk is a function of which two factors?

The likelihood of a threat event and its potential adverse impact.

Start playing free

  1. Asset price and purchase date
  2. Likelihood and impact ✔
  3. Number of users and number of servers

Why: Risk combines how likely something bad is with how much harm it would do. A likely but trivial event and an unlikely but catastrophic one can both rank as notable risks. Teams use this to prioritize.

Huh, didn't know that: NIST says impacts can include damage to reputation or financial loss at the organizational level.

The dad joke
How many symbols do you need to type on a keyboard to make a heart? Less than three.
Like this card?
Play the game

References

Answer: Likelihood and impact. Risk combines how likely something bad is with how much harm it would do. A likely but trivial event and an unlikely but catastrophic one can both rank as notable risks. Teams use this to prioritize.

  1. NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf
    risk is a function of the likelihood of a threat event’s occurrence and potential adverse impact should the event occur
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyUnder NIST SP 800-63B-4, what is the minimum length for a password used as the only authentication factor?Security & PrivacyWhat does NIST SP 800-63B-4 say about password rules like requiring a mix of symbols, digits and capitals?Security & PrivacyA legacy device can no longer be patched because the vendor ended support. What does NIST SP 800-40r4 suggest?

That's stuff everyone should know.