Impact

Impact-

Some organizations, such as the U.S.  National  Security Agency  (NSA),  add an  additional factor  to  the  threat/vulnerability/risk equation, in  the  form  of impact. If we consider the  value  of  the  asset  being threatened to  be  a factor, this  may  change whether we see  a risk  as being present or  not.   If we  revisit our  example of  lost  backup tape  and  stipulate that  the  unencrypted backup tapes  contain only our  collection of chocolate chip  cookie recipes,  we may not actually have  a risk The data being exposed would not  cause  us a problem, as there  was  nothing sensitive in  it and  we can  make  additional backups from the source data.  In this  particular case, we might safely say that  we have no  risk .