| Impact → |
Negligible
(A) |
Marginal
(B) |
Considerable
(C) |
Critical
(D) |
Catastrophic
(E) | |
|---|---|---|---|---|---|---|
| Consequence | Environment (IE) | Slight effect | Minor effect | Localized effect | Major effect | Massive effect |
| Asset (IA) | Slight damage | Minor damage | Medium damage | Major damage | Extensive damage | |
| Health (IH) | Slight physical or mental harm | Minor physical or mental harm | Major physical or mental harm | Single fatality | Multiple fatalities | |
| Business continuity (IB) | Minor visible or barely recognizable disruption of service | Limited service impact, small cost or rework | Temporary outage, noticable rework, some customer complaints | Major functional disruption of service, contractual penalties, negative public perception | Prolonged or complete outage of service, legal issues, loss of key customers, severe damage to reputation or trust | |
| Data protection (ID) | No data loss / no data disclosure | Loss of rebuildable secondary data, disclosure of public data | Loss of easily recoverable data, disclosure of internal data | Loss of recoverable data, disclosure of some protected data | Irrecoverable data loss, full disclosure of protected data | |
| ↓ Probability (within 3yrs) |
Certain (5) 81-100% |
A5 | B5 | C5 | D5 | E5 |
| Likely (4) 61-80% |
A4 | B4 | C4 | D4 | E4 | |
| Possible (3) 41-60% |
A3 | B3 | C3 | D3 | E3 | |
| Unlikely (2) 21-40% |
A2 | B2 | C2 | D2 | E2 | |
| Improbable (1) 0-20% |
A1 | B1 | C1 | D1 | E1 |
| ID | Threat | Original Factor | Mitigated Factor | Current Level | Treatment | QM Status | Valid until |
|---|---|---|---|---|---|---|---|
| R-001 | Missing or incomplete data backups | E4 | B2 | Low | (B)reduction | Approved | 31 Dec 2027 |
| R-002 | Misuse of mobile devices | C3 | B3 | Low | (B)reduction | Approved | 31 Dec 2027 |
