Consequence

The term “consequence” is not well-defined in the literature and confusion arises when compared to the terms "impact", "harm" or "effect". For example, the ISO definition found below is very general and does not distinguish between consequences for critical infrastructure, for people, for the environment, or for the economy. Such distinctions are required for two reasons:

1. For the CIP domain, consequences for critical infrastructure are of supreme importance, and other consequences may be ignored for certain applications (for example, when assessing the consequences of cascading effects).
2. For consequence analysis in the meaning of the ECI directive , assessment of consequences for people, the environment and the economy is needed according to the cross-cutting criteria mentioned there.

So far, we do not have a suggestion of specific terms for both cases. Thus the recommendation for the time being is to always clearly state if “consequence” or “consequence analysis” is being performed for CI alone or for use with the cross-cutting criteria.

Definitions

European Definitions

While the term is not officially defined in the ECI directive , cross-cutting criteria are mentioned as a metric to assess consequence.

National Definitions

Australia

Consequence is the outcome of an event or situation expressed qualitatively or quantitatively.

One definition describes consequence in terms of a loss, injury, disadvantage or gain, a second definition defines it as the effects on persons, society, the environment and the economy.

Outcome of an event affecting objectives.

Canada

Consequence is the outcome of an event or situation expressed qualitatively or quantitatively, being a loss, injury or disadvantage.

Consequence est le résultat d’une situation ou d’un évènement, exprimé qualitativement ou quantitativement, qu’il s’agisse d’une perte, d’une lésion ou d’un inconvénient.

United Kingdom

Consequence is impact resulting from the occurrence of a particular hazard or threat, measured in terms of the numbers of lives lost, people injured, the scale of damage to property and the disruption to essential services and commodities.

United States

Consequence is the effect of an event, incident, or occurrence, including the number of deaths, injuries, and other human health impacts along with economic impacts both direct and indirect and other negative outcomes to society (adapted from the 2010 DHS Risk Lexicon ).

Standard Definition

ISO/IEC 27000:2014 and ISO 31000:2009

The outcome of an event affecting objectives.

The standard notes that (a) an event can lead to a range of consequences, (b) a consequence can be certain or uncertain and in the context of Information Security is usually negative, (c) consequences can be expressed qualitatively or quantitatively and (d) initial consequences can escalate through knock-on effects.

See also

• Cross-cutting criteria
• Human Consequence
• Consequence analysis