Confidentiality  Ensuring that  information  stored or  processed on  the ECHA's IT  systems is  accessible only  to those  authorized to  have access The unauthorized  disclosure of information  is expected to have a  limited adverse effect on  ECHA. For example,  information classified  (according to the ECHA  policy “Classification and  Handling of ECHA  Information”) as internal,  or a limited piece of  information classified as  restricted (e.g. single  restricted  document) may  be disclosed or accessed  without authorization.  The unauthorized  disclosure of information  is expected to have a  moderate adverse effect  on ECHA. For example,  several “restricted”  documents or a limited  amount of ’highly  restricted information may  be disclosed or accessed  without authorization . The unauthorized  disclosure  of information is  expected to have a  severe adverse effect  on ECHA. Lot of highly  restricted information  may be disclosed or  accessed without  authorization, for  example an entire  database contains  confidential data (e.g.  REACH or Biocides  data).  Integrity  Safeguarding  that information  stored or  processed on  ECHA's IT  systems is  modified only  those authorized  to modify The unauthorized  modification or destruction  of information could be  expected to have a limited  adverse effect on  organizational operations,  organizational assets, or  individuals. For example,  information available for  internal users may be  destroyed but can be  restored from backups. The unauthorized  modification or  destruction of  information could be  expected to have a  moderate adverse effect on ECHA.  For example, information  publicly available (e.g  C&L Platform,  eChemPortal) or  important security related  configuration data may be  tampered. The unauthorized  modification or  destruction of  information could be  expected to have a  severe adverse effect  on ECHA. For example,  critical information used  for decision making in  ECHA core processes  or critical security  configuration data is tampered, or large  amount of business data  may be lost or corrupted  and cannot be restored  from backups. Availability Ensuring that  information  stored on the  ECHA's IT  systems and  systems  themselves are  available for  authorized users  when required The disruption of access  to information or use of an  IT-system is expected to  have a limited adverse  effect on ECHA. For  example, development  environment. The disruption of access  to information or use of an  IT-system is expected to  have a moderate adverse  effect on ECHA. For  example, some of  production system may  be unavailable for limited  time due to denial of  service (DoS) attack. The disruption of access  to information or use of  an IT-system could be  expected to have a  severe adverse effect  on ECHA. For example,  at least some of  business critical IT- services or applications  may be unavailable  several hours (within the  core hours).  The total magnitude of a risk is achieved by combining impact and probability. The matrix  below defines levels for the total magnitude. It is instructional and a simplified model that  helps to evaluate risks consistently. Document code:  PRO-0027.06  Security level:  Internal  Effective date:  15/01/2019  ICT Governance  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  80  of  92 Impact  High  Moderate  Low 