# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Identification
#### 4.1.6 Identification of Impact  
Simply put, impact is the \"consequential magnitude of harm\" from an attack [16]. Users and assets can be impacted by attacks in different ways. Providing specific details about the potential types of impact can help to ensure that a risk model accurately predicts the number and severity of potential losses. The CIA triad, which includes confidentiality, integrity, and availability, has been widely adopted as a suitable model for traditional IT systems and is integral to ensuring information security. Regarding cyber risk, papers measure the impact of a threat event as the level or amount of CIA (confidentiality, integrity, and availability) loss [43; 45; 47; 49; 50; 51; 52; 67; 68]. For IoT systems, it is crucial to consider the impact on network performance and how security controls may affect network functionality, given the trade-off between security level and impact on network performance [46]. One significant difference between IoT and traditional systems is the extensive use of automation, which poses new threats that may impact the cyber-physical operation of devices. Therefore, cyber security measures should prioritise privacy, trust, and accountability to mitigate the risks of cyber-physical impacts that can be both cyber- and physical based. The concept of cyber-physical impacts involves understanding the potential physical impacts that users may experience because of a cyber attack, which can lead to real-world consequences. For the use of IoT within organisations, 10 papers consider impact factors that affect organisational operations [41; 43; 44; 52; 60; 65; 67; 70; 71; 76]. First, three of the frameworks refer to \"business impact\" to describe the cumulative impact on a business, with factors that could vary depending on the business's practices [52; 70; 71]. One specific type of impact on a business is the decline in reputation for an IoT domain, company/provider [65], with attacks causing negative press. In turn, a loss of reputation could also mean the reduced value of a company/provider's worth [41; 60], with [PERSON] et al. [43] defining that the brand value loss is any tangible or intangible losses caused by an attack which can affect an organisation's integrity (reputation), which then leads to a loss of a brand's worth [43]. In contrast, attacks may cause operational impacts [44], meaning that a system no longer functions in the required way, which could then negatively impact enterprise/vocational activities [67; 76]. The direct impact of an attack on users contains several factors that affect day-to-day lives. However, the most extreme relates to human autonomy. The impact to life refers to the user's health being put at risk (especially in the case of IoMT environments), as an attack could be life threatening, [60; 76] which puts a user in physical danger [43], makes them unsafe [65; 66; 67], or leads to loss of life [64; 74]. From a more psychological angle, one paper targets the emotional impact on individuals [67]. This explores the emotions, attitudes and behavioural changes that are seen within the user once an attack has occurred, with these feelings being dependent on how serious an attack is and the personality of the individual. The impact of a cyber attack on a user's well-being can affect how they use other devices and their level of trust in them. In turn, attacks may lead to losses of important services, e.g., taking away essential services (such as water and power) [44]. This is reflected within the work of [PERSON] et al. [65], where there is a potential loss or wasting of energy, which costs an individual or organisation extra money, taking away invaluable resources needed to power a city. Other impact types relating to the loss of time [66], resilience, security, and reliability [64] of IoT services, can be considered, with typing being dependent on an IoT domain's needs. One of the most common IoT impacts towards both individuals and organisations is financial loss due to a successful attack [41; 43; 53; 60; 65].