CISSP-ISSMP: Information Systems Security Management Professional

Risk assessment (also called risk analysis) identifies and estimates risks and incorporates threat and vulnerability analysis. Mitigation consists of decisions and actions that reduce risk, while residual risk may remain after security measures are applied. Security risk is evaluated in relation to threats and vulnerabilities, including the likelihood that a threat will exploit a vulnerability.