Security Risk Assessment Scales

Probability
Negligible Very Low Low Medium High Very High Extreme Unlikely to occur 2 3 times every 5 years < = once per year < = once every 6 months < = once per month = > once per month = > once per day 0 1 2 3 4 5 6

Harm
Insignificant No impact Minor Significant Damaging Serious Grave No extra effort required to repair Tangible harm, extra effort required to repair Significant expenditure of resources required Damage to reputation and confidence Extended outage and / or loss of connectivity Compromise of large amounts of data or services Permanent shutdown Complete compromise 0 1 2 3 4 5

Risk = Probability X Harm

0 1-3 4-7 8- 14 15-19 20--30 NIL Low Medium High Critical Extreme