Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation.
Sources:
CNSSI 4009-2022
NIST SP 800-30 Rev. 1 under Vulnerability Assessment from CNSSI 4009
NIST SP 800-37 Rev. 2
NIST SP 800-39 under Vulnerability Assessment from CNSSI 4009
NIST SP 800-53 Rev. 5 from CNSSI 4009-2022
NIST SP 800-53A Rev. 5 from CNSSI 4009-2022
NISTIR 7622 under Vulnerability Assessment from CNSSI 4009

  Product or process of identifying attributes that render an entity, asset, system, network, or geographic area susceptible or exposed to threats.
Sources:
CNSSI 4009-2022 from DHS Lexicon Terms and Definitions - adapted

  Formal description and evaluation of the vulnerabilities in an information system.
Sources:
NIST SP 800-137 under Vulnerability Assessment from CNSSI 4009

  See vulnerability assessment.
Sources:
NIST SP 800-53 Rev. 5 under vulnerability analysis
NIST SP 800-53A Rev. 5 under vulnerability analysis

  Systematic examination of a system or product or supply chain element to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation.
Sources:
NIST SP 800-161r1-upd1 [11/1/2024 errata update] from NIST SP 800-53 Rev. 5 - adapted