Use of a set of methods, principles, or rules for assessing risk based on nonnumerical categories or levels.
Source(s):
NIST SP 800-30 Rev. 1
from
DHS Risk Lexicon