Controlled Document:Risk evaluation

● ● ● Risk matrix

	Impact →	Negligible (A)	Marginal (B)	Considerable (C)	Critical (D)	Catastrophic (E)
Consequence	Environment (IE)	Slight effect	Minor effect	Localized effect	Major effect	Massive effect
	Asset (IA)	Slight damage	Minor damage	Medium damage	Major damage	Extensive damage
	Health (IH)	Slight physical or mental harm	Minor physical or mental harm	Major physical or mental harm	Single fatality	Multiple fatalities
	Business continuity (IB)	Minor visible or barely recognizable disruption of service	Limited service impact, small cost or rework	Temporary outage, noticable rework, some customer complaints	Major functional disruption of service, contractual penalties, negative public perception	Prolonged or complete outage of service, legal issues, loss of key customers, severe damage to reputation or trust
	Data protection (ID)	No data loss / no data disclosure	Loss of rebuildable secondary data, disclosure of public data	Loss of easily recoverable data, disclosure of internal data	Loss of recoverable data, disclosure of some protected data	Irrecoverable data loss, full disclosure of protected data
↓ Probability (within 3yrs)	Certain (5) 81-100%	A5	B5	C5	D5	E5
	Likely (4) 61-80%	A4	B4	C4	D4	E4
	Possible (3) 41-60%	A3	B3	C3	D3	E3
	Unlikely (2) 21-40%	A2	B2	C2	D2	E2
	Improbable (1) 0-20%	A1	B1	C1	D1	E1

ID	Threat	Original Factor	Mitigated Factor	Current Level	Treatment	QM Status	Valid until
R-001	Missing or incomplete data backups	E4	B2	Low	(B)reduction	Approved	31 Dec 2027
R-002	Misuse of mobile devices	C3	B3	Low	(B)reduction	Approved	31 Dec 2027