ISO 28001:2007 Supply Chain Security Management B.3: B.3 Step two: classification of consequences

The consequences of each possible security incident should be rated high, medium or low, having regard to loss of life and economic loss (numerical scoring is allowed if translated into the qualitative scale), and the reasoning recorded. Setting thresholds too low means countermeasures are demanded for more scenarios than necessary; setting them too high leaves out countermeasures for consequences the organization or government could not bear. A high consequence is unacceptable except where likelihood is low, a medium consequence is unacceptable where likelihood is high, and a low consequence is usually acceptable; acceptability is a judgement about how much harm the organization or government will tolerate at given probabilities. Table B.2 describes each level in terms of death and injury, economic impact and environmental impact.