...

Harm and Impact Definitions for reference

¿POTENTIAL IMPACTS

TYPES OF IMPACTS

LOW

MODERATE

HIGH

Inconvenience, distress, or damage to standing or reputation

at worst, limited, short-term inconvenience, distress or embarrassment to any party

at worst, serious short term or limited long-term inconvenience, distress or damage to the standing or reputation of any party

severe or serious long-term inconvenience, distress or damage to the standing or reputation of any party (ordinarily reserved for situations with particularly severe effects or which affect many individuals)

Financial loss or agency liability

at worst, an insignificant or inconsequential unrecoverable financial loss to any party

at worst, a serious unrecoverable financial loss to any party

severe or catastrophic unrecoverable financial loss to any party

Harm to agency programs or public interest

at worst, an insignificant or inconsequential agency liability

at worst, a serious agency liability

severe or catastrophic agency liability

Impact of harm Harm to agency programs or public interests

at worst, a limited adverse effect on organizational operations or assets, or public interests. Examples of limited adverse effects are: (info)
mission capability degradation to the extent and duration that the organization is able to perform its primary functions with noticeably reduced effectiveness, or (ii) minor damage to organizational assets or public interests

at worst, a serious adverse effect on organizational operations or assets, or public interests. Examples of serious adverse effects are: (info)
significant mission capability degradation to the extent and duration that the organization is able to perform its primary functions with significantly reduced effectiveness; or (ii) significant damage to organizational assets or public interests

a severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples of severe or catastrophic effects are: (info)
severe mission capability degradation or loss of to the extent and duration that the organization is unable to perform one or more of its primary functions; or (ii) major damage to organizational assets or public interests

Unauthorized release of sensitive information

at worst, a limited unauthorized
release of personal, U.S.
government sensitive, or
commercially sensitive
information to unauthorized
parties resulting in a loss of
confidentiality with an expected
limited adverse effect on
organizational operations,
organizational assets, or
individuals

at worst, a release of personal,
U.S. government sensitive, or
commercially sensitive
information to unauthorized
parties resulting in loss of
confidentiality with an expected
serious adverse effect on
organizational operations,
organizational assets, or
individuals.

a release of personal, U.S.
government sensitive, or
commercially sensitive
information to unauthorized
parties resulting in loss of
confidentiality with an expected
severe or catastrophic adverse
effect on organizational
operations, organizational
assets, or individuals

Harm to personal safety

at worst, minor injury not
requiring medical treatment

at worst, moderate risk of minor
injury or limited risk of injury
requiring medical treatment

a risk of serious injury or death

Civil or criminal violations

at worst, a risk of civil or
criminal violations of a nature
that would not ordinarily be
subject to enforcement efforts

at worst, a risk of civil or
criminal violations that may be
subject to enforcement efforts

a risk of civil or criminal
violations that are of special
importance to enforcement
programs