Operational Resilience: Categorizing "Level of Harm" for Impact Tolerance

Intolerable harm is "harm" that would severely impact the client, possibly leading to loss of life, serious financial loss, or damage to the customer's reputation or the organization providing critical business services.

This level of harm requires immediate attention, and the organization should have plans and procedures to mitigate the risk of intolerable harm.

For example, in the case of a bank, disruption to its critical business services that would result in customers losing access to their accounts or funds would be classified as intolerable harm.

Harm refers to a level of harm that would cause significant disruption to the customer, potentially leading to financial loss or damage to the customer's reputation or the organization providing the critical business services.

This level of harm also requires attention, and the organization should have plans and procedures to manage the risk of harm.

For example, in the case of an e-commerce website, disruption to its critical business services that would prevent customers from placing orders or accessing their order history would be classified as "harm."

Inconvenience refers to a "level of harm" that would cause a minor customer disruption, such as temporary inconvenience or delay.

Still, it would not cause significant financial loss or damage to the customer's reputation or the organization providing critical business services.

This level of harm is less critical, but the organization should still have plans and procedures to manage the risk of inconvenience.

For example, in the case of a transportation company, a disruption to its critical business services that would cause a delay in the arrival of a package would be classified as "inconvenience."