An understanding of the potential consequences of a successful attack on an information asset by a threat.