Overview
Impact is the "how bad would it be?" half of risk. A highly likely event with negligible consequences barely matters; a rare event with catastrophic consequences may dominate your planning. This lesson explains how to think about impact across its many dimensions.
Learning objectives
- Define impact in a risk context.
- Enumerate the dimensions impact can take.
- Relate impact back to the CIA triad.
Core concept
Impact is the magnitude of harm if a risk materializes. It is rarely a single number, because harm shows up in several dimensions:
- Financial — direct losses, fines, recovery costs, lost revenue.
- Operational — disruption to business processes and services.
- Reputational — loss of customer and partner trust, often the longest-lasting harm.
- Legal / regulatory — penalties for breaching laws or contracts (e.g. data-protection regulations).
- Safety — in some systems (healthcare, industrial control), harm can be physical.
Each maps back to the CIA triad: a confidentiality breach drives reputational and legal impact; an availability outage drives operational and financial impact; an integrity failure can cause any of them.
How it works
Teams estimate impact using qualitative bands (Negligible / Minor / Moderate / Major / Severe) or monetary ranges, considering the worst realistic case rather than the absolute worst imaginable. Crucially, impact is judged per asset: the same type of incident affecting a test database and a production customer database have very different impacts.
Practical example
A one-hour outage of an internal wiki has minor operational impact and little else. A one-hour outage of a hospital's medication system has severe operational and safety impact. The technical event is similar; the impact — and therefore the risk and the justified spending — is worlds apart.
Cybersecurity relevance
Impact analysis feeds Business Impact Analysis (BIA) and disaster-recovery planning, which decide how quickly each system must be restored. Understanding impact is why some systems get gold-plated protection and others get the minimum.
Common mistakes
- Measuring only financial impact and ignoring reputation, legal, and safety.
- Using the same impact for an asset regardless of context (test vs. production).
- Planning for the worst imaginable rather than worst realistic, distorting priorities.
Key takeaways
- Impact is the magnitude of harm across financial, operational, reputational, legal, and safety dimensions.
- It is judged per asset and maps back to the CIA property that fails.
- Estimate the worst realistic case, not just the worst possible one.
Check your understanding
- List three impact dimensions for a breach of a retailer's payment system.
- Why can the same technical outage have wildly different impact on two systems?