Cyber Security Case Studies has worked with a number of groups to develop these risk effect categories which represent a plain-english description of the impacts seen in public cyber events alongside their definition:

• Cancellation - Ostracism in which a brand or company is forced out of social/professional circles for a perceived failure/misconduct.
• Compliance - Non-compliance with regulatory or legislative requirements.
• Exploitation I&II - Private information stolen to obtain unauthorized benefits or to sell the information to a third party.
• Exploitation III&IV - Victim’s digital or physical capabilities used without its knowledge or consent.
• Extortion I&II - Extract non-monetary or monetary concessions from the victim in exchange for not negatively impacting their reputation, disrupting their operations or exploiting or destroying their assets.
• Operational Destruction I&II - Deliberate destruction of victim’s digital or physical assets.
• Operational Disruption I&II - Temporary disruption of victim’s information and/or physical processes through the misuse or blockage of digital and physical asset.
• Operational Manipulation I&II - Distortion of victim’s information or decision and control processes with the goal of manipulating the operating behaviour with targeted internal or external impact.
• Reputational Damage I - Non-public information accessed and disclosed by victim as part of best practice or regulatory compliance.
• Reputational Damage II&III - Victim’s defences defeated and proof shared with the public or stakeholders which shames them for their inability to protect the information or shames individuals with its content.
• Self-regulation - Non-compliance with self-imposed standard or best practice.
• Violation I - Non-public information accessed but without impact/disclosure.