ISO/SAE 21434 RQ-15-05: [RQ-15-05] Impact rating levels

Each damage scenario shall be rated for impact as severe, major, moderate or negligible; Annex F supplies tables for the financial, operational and privacy categories.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Clause 15: Threat analysis and risk assessment methods – ISO/SAE 21434

RC-15-11 [RC-15-11] Attack feasibility method
RC-15-12 [RC-15-12] Attack-potential-based approach
RC-15-13 [RC-15-13] CVSS-based approach
RC-15-14 [RC-15-14] Attack-vector-based approach
RQ-15-01 [RQ-15-01] Damage scenarios
RQ-15-02 [RQ-15-02] Assets with cybersecurity properties
RQ-15-03 [RQ-15-03] Threat scenarios
RQ-15-04 [RQ-15-04] Impact rating in four categories

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISO/SAE 21434 controls