Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Risk Management
  4. >Risk Management - Objective 3
  5. >C2M2-RISK-3C
C2M2-RISK-3CActive

A defined method is used to estimate impact for higher priority cyber risks (for example, comparison to actual events, risk quantification)

Statement

A defined method is used to estimate impact for higher priority cyber risks (for example, comparison to actual events, risk quantification)

Location

Domain
Risk Management
Objective
Risk Management - Objective 3

Practice Details

Identifier
C2M2-RISK-3C
Domain
Risk Management
Objective
Objective 3
Maturity Level
MIL-2

Help Text

A defined method to estimate the impact of risks and risk categories (e.g., safety impacts, operational disruption, potential cost of downtime, cost of lost data, and cost of recovery) is beneficial since it provides a common comparison point for risks. This method helps identify and prioritize the most critical risks that could impact operations. Mathematical or statistical methods may be used to determine a value such as the potential cost if a risk is realized.

Related Practices · Input From: Implementing RISK-3a provides input that may be useful for implementing this practice. · Progression: This practice is part of multiple practice progressions. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in the first progression include: RISK-3b, RISK-3c, RISK-4c, RISK-4d. · The practices in the second progression include: RISK-3c, RISK-3d, RISK-3e.

AESCSF
AESCSF-RISK-3cequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Risk Management - Objective 3
Risk Management - Objective 37 controls
C2M2-RISK-3ACyber risks are prioritized based on estimated impact, at least in an ad hoc mannerC2M2-RISK-3BDefined criteria are used to prioritize cyber risks (for example, impact to the organization, impact to the community, likelihood, susceptibility, risk tolerance)C2M2-RISK-3CA defined method is used to estimate impact for higher priority cyber risks (for example, comparison to actual events, risk quantification)C2M2-RISK-3DDefined methods are used to analyze higher priority cyber risks (for example, analyzing the prevalence of types of attacks to estimate likelihood, using the results of controls assessments to estimate susceptibility)C2M2-RISK-3EOrganizational stakeholders from appropriate operations and business functions participate in the analysis of higher priority cyber risksC2M2-RISK-3FCyber risks are removed from the risk register or other artifact used to document and manage identified risks when they no longer require tracking or responseC2M2-RISK-3GCyber risk analyses are updated periodically and according to defined triggers, such as system changes, external events, and information from other model domains