The potential impact of a security incident can be categorised using the same categories that businesses generally use to describe any type of risk: *financial, reputational, strategic, operational, and compliance*. ### Financial Risk Financial risk is, as the name implies, the **risk of monetary damage** to the organisation as the result of a data breach. This may be very *direct financial damage*, such as the costs of rebuilding a datacenter after it is physically destroyed or the costs of contracting experts for incident response and forensic analysis services. Financial risk may also be *indirect and come as a second-order consequence* of the breach. For example, if an employee loses a laptop containing plans for a new product, the organisation suffers direct financial damages of a few thousand dollars from the loss of the physical laptop. However, the indirect financial damage may be more severe, as *competitors may gain hold of those product plans and beat the organisation to market, resulting in potentially significant revenue loss*. ### Reputational Risk Reputational risk occurs when the **negative publicity surrounding a security breach causes the loss of goodwill** among customers, employees, suppliers, and other stakeholders. It is often difficult to quantify reputational damage, as these stakeholders may not come out and directly say that they will reduce or eliminate their volume of business with the organisation as a result of the security breach. However, the breach may still have an impact on their future decisions about doing business with the organisation. ### Strategic Risk Strategic risk is the risk that an organisation will **become less effective in meeting its major goals and objectives as a result of the breach**. Consider again the example of an employee losing a laptop that contains new product development plans. This incident may pose strategic risk to the organisation in two different ways. First, if the organisation does not have another copy of those plans, *they may be unable to bring the new product to market* or may suffer significant product development delays. Second, if competitors gain hold of those plans, they may be able to bring competing products to market more quickly or even beat the organisation to market, gaining first-mover advantage. Both of these effects demonstrate strategic risk to the organisation's ability to carry out its business plans. ### Operational Risk Operational risk is *risk to the organisation's ability to carry out its day-to-day functions*. Operational risks may slow down business processes, delay delivery of customer orders, or require the implementation of time-consuming manual work-arounds to normally automated practices. *Operational risk and strategic risk are closely related*, so it might be difficult to distinguish between them. If a risk **threatens the very existence of an organisation** or the ability of the organisation to execute its business plans, that is a **strategic risk** that seriously jeopardises the organisation's ongoing viability. On the other hand, if the risk **only causes inefficiency and delay** within the organisation, it fits better into the **operational risk** category. ### Compliance Risk Compliance risk occurs *when a security breach causes an organisation to run afoul of legal or regulatory requirements*. For example, the Health Insurance Portability and Accountability Act (HIPAA) requires that health-care providers and other covered entities protect the confidentiality, integrity, and availability of protected health information (PHI). If an organisation loses patient medical records, they violate HIPAA requirements and are subject to sanctions and fines from the U.S. Department of Health and Human Services. That's an example of compliance risk.