Document code:  PRO-0027.06  Security level:  Internal  Effective date:  15/01/2019  ICT Governance  5. Risk impact, i.e. severity of occurred threat, is evaluated. Criteria used to evaluate  the impact are: level of lost confidentiality, integrity, and availability of  information. The levels are described later in this section in more detail. 6. The total magnitude of risk is achieved by combining the impact and probability.  • ECHA’s specific data of occurred threats/risks and security events, where risks  have not occurred but realization has been very close, e.g. intrusion attempts to  ECHA internal network • Non-public data from other organization through existing professional networks  and other relationships (e.g. CERT-EU, CERT-FI) • Public data, especially if there is any statistics of occurred threat or risk  • Frequent  –  Expected to occur often or at least several times in the service/system  lifetime; occurs frequently  • Occasional  –  Occurs few times in service/system lifetime. Expected to occur at  least twice in service/system life time; occurs periodically. • Seldom - Possible to occur in service/system lifetime. Expected to occur once in  service/system life; occurs rarely.  • Unlikely - not assumed to occur in service/system lifetime. Possible, but  improbable; occurs only very rarely. 6  The risk might have occurred once or couple of times but there is no enough data for statistical assessment  Page  79  of  92 TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  IMPACT OF LOSS  LOW  MODERATE  HIGH  Risk impact, i.e. severity of occurred threat, is evaluated using the level of loss of  confidentiality, integrity, and availability as criteria. The matrix below defines levels of  confidentiality, integrity, and availability with a high level guidance as to how those levels  should be applied. While the probability of risk occurrence cannot be  measured , but only  estimated , the risk  probability is mapped to a pre-defined category instead of trying to find exact numeric  value. In ECHA’s risk management model there are the following categories defined:  Also, subjective view as an inaccuracy factor is reduced by discussing with other experts,  and taking into account their view. Probability estimation is often the most challenging part of risk assessment. It is  particularly true for IT security risks where historical data on previous occurred risks are  either not available or not relevant. Most IT security risks are possible future events that  have not yet occurred 6  in the current IT environment, and as such, their probability  cannot be measured but only estimated. The process is undermined when probability  estimation appears to be a subjective opinion. Thus, in order to ensure the credibility and  value of the IT security risk management process, data shall be collected from the  following information sources and assessed with care: