3.2.2 Identify Potential Impact Levels

Before · SP 800-63-3

After · SP 800-63-4

Identify Potential Impact Levels

Before · SP 800-63-3

After · SP 800-63-4

In this step, the organization assesses the potential level of impact caused by an unauthorized user gaining access to the online service for each of the impact categories selected by the organization (from Sec. 3.2.1 ). Impact levels are assigned using one of the following potential impact values:

• Low : Expected to have a limited adverse effect

• Moderate : Expected to have a serious adverse effect

• High : Expected to have a severe or catastrophic adverse effect Each user group can have a distinct set of privileges and functionalities through the online service. Hence, it is necessary to consider the adverse consequences for each set of impacted entities in each of the impact categories, as a result of an intruder obtaining unauthorized access as a member of a particular user group. To provide a more objective basis for impact level assignments, organizations SHOULD develop thresholds and examples for the impact levels for each impact category. Where this is done, particularly with specifically defined quantifiable values, these thresholds SHALL be documented and used consistently in the DIRM assessments across an organization to allow for a common understanding of risks.

Examples of potential impacts in each of the impact categories include:

• Degradation of mission delivery:

– Low : Expected to result in limited mission capability degradation such that the organization is still able to perform its primary functions but with some reduced effectiveness

– Moderate : Expected to result in serious mission capability degradation such that the organization is still able to perform its primary functions but with significantly reduced effectiveness

– High : Expected to result in severe or catastrophic mission capability degradation or loss over a duration such that the organization is unable to perform one or more of its primary functions

• Damage to trust, standing, or reputation:

– Low : Expected to result in limited, short-term inconvenience, distress, or embarrassment to any party

– Moderate : Expected to result in serious short-term or limited long-term inconvenience, distress, or damage to the standing or reputation of any party

– High : Expected to result in severe or serious long-term inconvenience, distress, or damage to the standing or reputation of any party or many individuals

• Unauthorized access to information:

– Low : Expected to have a limited adverse effect on organizational operations, organizational assets, or individuals, as defined in [FIPS199]

– Moderate : Expected to have a serious adverse effect on organizational operations, organizational assets, or individuals, as defined in [FIPS199]

– High : Expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals, as defined in [FIPS199]
• Financial loss or financial liability:

– Low : Expected to result in limited financial loss or liability to any party

– Moderate : Expected to result in a serious financial loss or liability to any party

– High : Expected to result in severe or catastrophic financial loss or liability to any party

• Loss of life or danger to human safety, human health, or environmental health:

– Low : Expected to result in a limited impact on human safety or health that resolves on its own or with a minor amount of medical attention or a limited impact on environmental health that requires at most minor intervention to prevent further damage or reverse existing damage

– Moderate : Expected to result in a serious impact on human safety or health that requires significant medical attention, serious impact on environmental health that results in a period of uninhabitability and requires significant intervention to prevent further damage or reverse existing damage, or the compounding impacts of multiple low-impact events

– High : Expected to result in a severe or catastrophic impact on human safety or health, such as severe injury, trauma, or death, a severe or catastrophic impact on environmental health that results in long-term or permanent uninhabitability and requires extensive intervention to prevent further damage or reverse existing damage, or the compounding impacts of multiple moderate impact events

This guideline provides three impact levels. However, organizations MAY define more granular impact levels and develop their own methodologies for their initial impact assessment activities.