An incorrect or subobtimal configuration of an information system or system component that may lead to vulnerabilities. -NIST.gov