Categories of Harm and Impact Definitions

HARM	LOW IMPACT	MODERATE IMPACT	HIGH IMPACT
Inconvenience, distress, or damage to standing or reputation	at worst, limited, short-term inconvenience, distress or embarrassment to any party	at worst, serious short term or limited long-term inconvenience, distress or damage to the standing or reputation of any party	severe or serious long-term inconvenience, distress or damage to the standing or reputation of any party (ordinarily reserved for situations with particularly severe effects or which affect many individuals)
Financial loss	at worst, an insignificant or inconsequential unrecoverable financial loss to any party	at worst, a serious unrecoverable financial loss to any party	severe or catastrophic unrecoverable financial loss to any party
Agency liability	at worst, an insignificant or inconsequential agency liability	at worst, a serious agency liability	severe or catastrophic agency liability
Harm to agency programs or public interests	at worst, a limited adverse effect on organizational operations or assets, or public interests. Examples of limited adverse effects are: (1) mission capability degradation to the extent and duration that the organization is able to perform its primary functions with noticeably reduced effectiveness, or (2) minor damage to organizational assets or public interests	at worst, a serious adverse effect on organizational operations or assets, or public interests. Examples of serious adverse effects are: (1) significant mission capability degradation to the extent and duration that the organization is able to perform its primary functions with significantly reduced effectiveness; or (2) significant damage to organizational assets or public interests	a severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples of severe or catastrophic effects are: (1) severe mission capability degradation or loss of to the extent and duration that the organization is unable to perform one or more of its primary functions; or (2) major damage to organizational assets or public interests
Unauthorized release of sensitive information	at worst, a limited unauthorized release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with an expected limited adverse effect on organizational operations, organizational assets, or individuals	at worst, a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with an expected serious adverse effect on organizational operations, organizational assets, or individuals.	a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with an expected severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals
Harm to personal safety	at worst, minor injury not requiring medical treatment	at worst, moderate risk of minor injury or limited risk of injury requiring medical treatment	a risk of serious injury or death
Civil or criminal violations	at worst, a risk of civil or criminal violations of a nature that would not ordinarily be subject to enforcement efforts	at worst, a risk of civil or criminal violations that may be subject to enforcement efforts	a risk of civil or criminal violations that are of special importance to enforcement programs