The original post: /r/cybersecurity by /u/Familiar-Barber-9250 on 2025-03-13 09:50:31.

I’ve come across a cybersecurity control on identity verification that states:

“Identity verification: It must be ensured that appropriate verification factors and their quantity are determined, as well as the appropriate verification technologies, based on the results of the impact assessment of potential verification failure. This applies to user login processes.”

This raises a few questions:

1. Does “Impact Assessment” actually exist as a standalone process in cybersecurity, or is it only part of Risk Assessment? • I usually see “impact” evaluated within risk assessments, but I don’t see “Impact Assessment” as a separate requirement. • The term is commonly used in change management, so do they mean it in that sense, or does it have another meaning here?
2. If an impact assessment does exist in cybersecurity, how is it conducted, and when should it be performed? • What factors would need to be assessed in this context (identity verification failures)?