Evaluation made on the extent or frequency of exposure to an identified risk. May be classified as Highly Vulnerable, Vulnerable, or Not Vulnerable. Establishes significance of risks and the potential impact to the ongoing business functions. Important factor to be considered in establishing priorities in mitigation activities. (Jones, Critical Incident Protocol, 2000, 37)