Appendix A  – Impact to Confidentiality, Integrity and Availability (CIA)

				Impact to CIA (H/M/L)
Category	Asset	Description	Value to Threat Actor	C	I	A
IT Assets	Servers	Servers that we use to run our own business but also data centers that we use to support our customer’s business	Very high value as they can not only obtain info on our business but also many of our customer’s business	H	H	H
	User Devices	Cell phones, tablets, PC’s, Laptops.  Many of which are now BYOD	Represents a wide attack surface and many more vectors of attack to gain access to the network and critical information.	H	M	L
	People	The general IT staff who maintain the servers, applications, contracts, network configuration, etc	IT personnel are a great target given their admin privileges.	H	M	M
	Storage Media	This includes our Disaster Recovery back-up media, active storage for email accounts and cloud storage	High value asset as this will provide a threat actor with historical information and current data	H	M	H
Critical Information	Intellectual property	This is all of our current patents in process and future technology roadmap	This would provide a threat actor insight into our future technology pipeline.  Usually kernel technology (~3-5 years in the future)	H	M	L
	Product Development Plans & M&A	Product roadmap which includes co-development and joint go-to-market strategies with partners and customers.  This also includes M&A proposals and activity	Tremendously valuable to a bad guy as this can be used to game the stock on an M&A target for financial gain.  Additionally, it can be used to disclose info to our competitors	H	H	L
	Business Plans	This includes our revenue targets by region/industry segment and sales territories	Has some value but it is only a plan, it may be useful to potentially game our stock price if it can be reconciled with the current pipeline data	M	L	L
	Organization Charts	Contains all 90K employees along with the reporting line – phone numbers, email, title, location and skills	This is a perfect data source to obtain for phishing attacks	H	L	L
	Sales Pipeline Data	This includes worldwide pipeline data	Current sales pursuits, pricing proposals, and customer contacts	H	M	M
	Historical sales reports (product, territory, channel)	Historical sales will provide customers, what they bought, how much they paid, the sales territory, customer contact info	This is tremendously valuable for a threat actor who is intent on damaging our business.  They could provide this confidential data to other customers.	H	M	L
	On-going and previous legal cases	Legal cases in process include employment law, defense claims, settlement offers, M&A, etc	A breach of confidentiality could create a massive liability for the company	H	L	M