Overview
Impact is the assessment of what the incident actually cost the organization — which systems, data, and business functions were affected, and to what degree. It translates technical events into business consequences.
Learning objectives
- Define impact assessment in an incident report.
- Identify the dimensions of impact to evaluate.
- Explain why accurate, evidence-based impact matters to the organization.
Core concept
Impact describes the consequences of the incident: what was affected and how badly. It spans several dimensions — systems (which hosts/services were compromised or disrupted), data (what was accessed, altered, or exfiltrated, and its sensitivity), operations (business functions disrupted, downtime, productivity loss), and broader effects such as financial cost, reputational harm, and regulatory/compliance implications (e.g. whether breach-notification obligations are triggered). Impact assessment turns the technical timeline and evidence into terms the organization cares about, and it directly informs the executive summary and decisions about notification, resourcing, and priorities. It must be evidence-based and honest: neither overstated (causing unnecessary alarm and cost) nor understated (leading to under-response or missed legal obligations). Where evidence is inconclusive — for example, whether data was actually exfiltrated versus merely accessible — the impact section says so clearly rather than guessing in either direction.
How it works
Using the timeline and evidence, the SOC assesses impact across dimensions. It determines scope of systems affected (from the confirmed compromised hosts/accounts), then assesses data impact: what data resided on or was reachable from those systems, whether logs/network evidence show it was accessed or exfiltrated, and how sensitive it is (personal data, credentials, IP). It evaluates operational impact (downtime, disrupted services, response effort) and considers financial and reputational effects. Critically, it maps impact to regulatory/legal obligations — many jurisdictions require breach notification when certain personal data is exposed, so the data-impact finding can trigger legal and communications processes. Throughout, conclusions are tied to evidence and stated with appropriate certainty: "confirmed exfiltration of X" differs sharply from "data was accessible but no evidence of exfiltration found," and the report distinguishes them. This honest, evidence-grounded impact picture feeds the executive summary and drives proportionate decisions.
Practical example
For the intrusion, the SOC assesses impact. Systems: four workstations compromised, isolated and rebuilt. Data: the hosts held internal documents; network flow evidence shows a connection to attacker infrastructure, but the volume and content transferred could not be confirmed — so the report states data was accessible and a small outbound transfer occurred, with no confirmed exfiltration of sensitive personal data, explicitly flagging the uncertainty. Operations: the four users lost productivity during rebuild; no customer-facing service was down. Regulatory: because no personal data exposure was confirmed, mandatory breach notification did not appear triggered, but legal was consulted to confirm. This precise, evidence-based impact statement — distinguishing confirmed from possible, and connecting to regulatory obligations — lets leadership make proportionate decisions and feeds an accurate executive summary, rather than either downplaying or exaggerating the event.
Cybersecurity relevance
Impact is where technical findings become business meaning, driving the decisions that matter most after an incident: notification obligations, resource allocation, communications, and prioritization. An accurate, evidence-based, honestly-caveated impact assessment — spanning systems, data, operations, financial, reputational, and regulatory dimensions — ensures the organization responds proportionately and meets its legal duties, while overstated or understated impact leads to wasted cost or dangerous under-response and compliance failures. Building on the timeline and evidence, and connecting to the executive summary, impact assessment is the section that most directly shapes organizational consequences.
Common mistakes
- Overstating impact (causing unnecessary alarm/cost) or understating it (under-response, missed legal obligations).
- Confusing "data accessible" with "data exfiltrated", asserting certainty the evidence doesn't support.
- Overlooking regulatory/notification implications of the data affected.
Key takeaways
- Impact assesses the incident's consequences across systems, data, operations, financial, reputational, and regulatory dimensions.
- It translates the timeline and evidence into business terms, feeding the executive summary and decisions on notification and resourcing.
- It must be evidence-based and honest about certainty — distinguishing confirmed from possible, and flagging regulatory obligations.
Check your understanding
- What dimensions of impact should an incident report assess, and why include regulatory implications?
- Why must impact distinguish "data accessible" from "data exfiltrated," and be neither overstated nor understated?