The process of identifying, assessing, and prioritizing potential risks to an organization's information assets.