# About Clause 6.1.2: I| **6** | **[Planning](ISO_27001_2022_6_MoC%20Planning.md)**                                                                                                                                |
| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| 6.1   | [Actions to address risks and opportunities                                   ](ISO_27001_2022_6.1_MoC%20Actions%20to%20address%20risks%20and%20opportunities.md) |
| 6.1.1 | [General                                                                      ](ISO_27001_2022_6.1.1_MoC%20General.md)                                                            |
| 6.1.2 | [Information security risk assessment                                         ](ISO_27001_2022_6.1.2_MoC%20Information%20security%20risk%20assessment.md)                               |
| 6.1.3 | [Information security risk treatment                                          ](ISO_27001_2022_6.1.3_MoC%20Information%20security%20risk%20treatment.md)                                |
| 6.2   | [Information security objectives and planning to achieve them                 ](ISO_27001_2022_6.2_MoC%20Information%20security%20objectives%20and%20planning%20to%20achieve%20them.md) |
| 6.3   | [Planning of changes                                                          ](ISO_27001_2022_6.3_MoC%20Planning%20of%20changes.md) |rity investments will deliver the most value. This is in line with the ISO 31000 standard for Risk Management #research title? , which recommends categorizing risks based on your organization’s context and objectives.

Different organizations worry about different kinds of risks, based on their mission, industry, and stakeholder expectations. An engineering firm may worry about their designs being stolen (protection of intellectual property) and construction errors due to incorrect data or calculations (integrity of information). A hospital will worry about continuity (availability of information) and patient confidentiality. A social media advertising platform, may care less about compliance with privacy regulations, but place great emphasis on uptime of systems.

To help in this dialogue about risks and risk tolerance, we can use the concept of 'Impact Categories'. 
## Impact Categories
Impact Categories are the types of business consequences that matter most to an organization's leadership, because they affect the organization's ability to achieve its objectives.

Below is a list of examples of Impact Categories:

- **Operational**: Disruption of day-to-day processes, workforce capability, system functionality, and the organization's ability to deliver products or services
- **Financial**: Direct financial losses, increased costs, reduced revenue, market value decline, or threats to financial stability
- **Strategic**: Inability to achieve long-level organizational goals, loss of competitive position, or forced changes to business direction
- **Compliance**: Legal penalties, regulatory sanctions, loss of licenses or certifications, or mandatory remediation costs
- **Reputational**: Loss of customer trust, damage to brand value, negative media attention, or erosion of stakeholder confidence
- **Health and Safety**: Physical harm to employees, customers, or the public, or creation of unsafe conditions
- **Environmental**: Environmental damage, pollution incidents, or failure to meet sustainability commitments
- **Competitive Advantage**: Loss of proprietary knowledge, patents, trade secrets, or strategic business intelligence
- **National Security**: Consequences for critical infrastructure, public safety, or national interests

You can expand and adapt this list as you see fit. Engage your management in a dialogue about areas of impact, and aim to establish the categories that are most important to them. This will help in weighing priorities later on. 

## qualifying or quantifying risks?

**Qualifying risks** (qualitative risk assessment) involves describing and categorizing risks using descriptive scales or labels—such as rating likelihood as "low, medium, high" and impact as "minor, moderate, severe"—focusing on understanding the nature and relative severity of risks without precise numerical values.

**Quantifying risks** (quantitative risk assessment) involves measuring risks using specific numerical values—such as calculating the probability as a percentage (e.g., 15% chance per year) and impact in monetary terms (e.g., €50,000 loss)—providing precise, measurable data that can be used for detailed cost-benefit analysis and statistical modeling.

Clause 6.1.2 writes we should "assess the potential consequences" and "realistic likelihood" of risks occurring, but the standard doesn't say anything about *how* these should be established (just that that the chosen method must produce "consistent, valid and comparable results").

The core _requirements_ in ISO/IEC 27001 remain method-agnostic as long as the steps above are met and results are consistent and comparable.

The organization must set its own criteria for determining risk levels and risk acceptance criteria. The organization defines these elements based on its specific needs, size, structure, objectives, and risks.

The standard does not say anything about if qualitative or quantitative risk assessment should be applied.
