Risk is modeled as part of the Security Viewpoint of UAF, which came from the Canadian DnDAF framework. Since NAF 4 is built using the UAF metamodel, Risk is available in NAF 4 as a definition type.

Risk is a statement of the impact of an event on Assets. It represents a constraint on an Asset in terms of adverse effects, with an associated measure. The measure is used to capture the extent to which an entity is threatened by a potential circumstance or event. Risk is typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. Software related security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems.