What it means
Impact translates a technical failure into consequences for people and the organization. A deleted table matters because appointments disappear, invoices become wrong, or an essential service stops. Start with the activity that depends on the asset, then describe the harm if confidentiality, integrity, or availability fails.
Consequences may grow with time and spread through dependencies. An hour of disruption during a quiet period may differ from an hour during payroll or emergency operations. Include safety, privacy, financial loss, service delivery, and recovery effort where relevant. Keep the consequence estimate separate from how likely the event is to occur.
AN ILLUSTRATIVE SCENARIO
A water utility maintenance system
A utility uses a scheduling application to coordinate field repairs. Losing access to the application would delay planned work; corrupting the location of an urgent repair could misdirect a crew. Operations staff explain that a paper dispatch process can cover a short outage, but it cannot sustain a full day of changing assignments. The security team documents those distinct consequences and the limits of the fallback. It avoids assigning an arbitrary financial total without operational evidence.
Put it to work
- Ask the service owner who depends on the asset, what decisions it supports, and what happens when its information becomes wrong or unavailable.
- Describe plausible consequences at meaningful durations or scales, including dependencies and existing manual workarounds.
- Use an agreed impact scale and record its rationale, assumptions, and the owner who can validate the business consequences.
How to check your work
Check the assessment with the people running the service. They should recognize the stated consequences, confirm the fallback's limits, and identify the point where a disruption becomes materially worse.
Connect the ideas
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
- Asset
Anything whose disclosure, alteration, destruction, or downtime would harm a person or organization.
- CIA triad
A shorthand for naming whether a loss is disclosure, unauthorized change, or downtime.