A systematic review and analysis of security weaknesses in an information system, evaluating if the system is susceptible to known vulnerabilities and assigning severity levels.