Information Security Handbook

Estimating impact

The impact that an organization may experience is the level of disruption that the organization expects because of the following:

• Unauthorized modification of information
• Theft of information
• Unauthorized destruction of information
• Loss of information system availability

This loss can be experienced throughout the organization as a whole, or can be directed at a specific business unit. It is important to make a careful assessment of business impact as things may not be as they seem if you rush through the process. An impact to the entire organization may not cause as large of an impact compared to something that happens within a specific business unit.

As an example, the organization may be able to reasonably tolerate ...