An occurrence that actually or potentially results in adverse consequences to (adverse effects on) (poses a threat to) an information system or the information that the system processes, stores, or transmits and that may require a response action to mitigate the consequences.

Source: Explore Terms: A Glossary of Common Cybersecurity Terminology National Initiative for Cybersecurity Careers and Studies (NICCS),