I'm using SecureAware by Neupart/Lightwave as ISMS.

This, otherwise fine program, asks me to fill in Threat Impact for all threads in the usual categories of Confidentiality, Integrity and Availability.

Later on when doing the risk assessments it tells me to do business impact for Confidentiality, Integrity and Availability. This makes a whole lot of sense, but I have no idea what it wants a Threat Impact for.

Can anyone tell me what a Threat Impact is and how it is used in the risk assessment?

Best regards


  • A threat might affect your infrastructure, but it doesn't necessarily affect your business. for example, say, there is a threat that takes down your monitoring software, but it does not affect the business directly. – JOW Dec 9 '15 at 13:22

Threat impact generally refers to impact on Confidentiality, Availability, or Integrity to the organization, system, or dataset.

Business impact is an estimate of the damage to the organization in a long-term sense. In most cases this term just refers to actual financial impact but in some cases it may include many other dimensions such as market positioning.

In many cases, these two impacts are frequently graphed as an X and Y access to give the business a better view of how several of the risks to a business compare.

Simply put the reason you would want this is there are business assets that can be completely destroyed or taken off-line which would have almost no effect on the business. If in this case there were a really easy to exploit critical vulnerability you may rate it as (Threat impact HIGH, Business impact LOW)

... and at the same time if this business had other services which if they were even slightly damaged or taken off-line would create a HUGE impact on the business and those services had a very minor vulnerability which wouldn't cause a loss of data but may radically slow the site down you may rate it as (Threat impact LOW, Business impact HIGH)

Rather than a company rating all assets equally and trying to protect all assets equally, or going after the HIGH Threat impact issues first, it is more important to prioritize the ones which could have the greatest impact on the business.

Having separate ratings like this help businesses and security teams focus their time and money better.

  • So threat impact is "how much will we loose" and business impact is "how much will it hurt"? – Martin Verner Dec 10 '15 at 6:57
  • Yes, it has a few more dimensions data-wise to it but that analogy is basically correct. – Trey Blalock Dec 10 '15 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.