{"id":2649,"date":"2026-09-23T09:00:00","date_gmt":"2026-09-23T06:00:00","guid":{"rendered":"https:\/\/www.dataeye.ro\/?p=2649"},"modified":"2026-10-28T02:09:37","modified_gmt":"2026-10-28T00:09:37","slug":"how-to-prioritise-it-risks-likelihood-impact","status":"publish","type":"post","link":"https:\/\/www.dataeye.ro\/en\/blog\/how-to-prioritise-it-risks-likelihood-impact\/","title":{"rendered":"How to prioritise IT risks: likelihood \u00d7 impact"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Every security assessment produces a list of risks. The challenge is not identifying them, but deciding what to fix first. At Dataeye we start from a simple principle: we separate what is critical from what is just a box to tick. The basic tool is assessing each risk on two axes: likelihood and impact.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Likelihood: how credible is the scenario?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We use a scale from 1 to 5:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>1 \u2013 Rare:<\/strong> an exceptional event, with no relevant indicators;<\/li>\n\n\n\n<li><strong>2 \u2013 Unlikely:<\/strong> it may occur under certain conditions;<\/li>\n\n\n\n<li><strong>3 \u2013 Possible:<\/strong> a credible scenario, supported by concrete factors or dependencies;<\/li>\n\n\n\n<li><strong>4 \u2013 Likely:<\/strong> there are clear signals or insufficient controls;<\/li>\n\n\n\n<li><strong>5 \u2013 Almost certain:<\/strong> the risk is imminent, recurring or already materialising.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Impact: what happens if the risk materialises?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Impact is also assessed on a scale from 1 to 5, from <em>Very low<\/em> (a minor effect, with no significant consequences) to <em>Critical<\/em> (it may lead to business disruption, operational incidents or serious consequences). What matters is not only the technical perspective, but also the effect on the business: service availability, data confidentiality, legal obligations and reputation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">From score to decision<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Combining the two scores gives you the exposure level of each risk. A likely risk with critical impact goes to the top of the list; a rare risk with low impact can be monitored or accepted temporarily, in a deliberate and documented way.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To keep decisions fast and predictable, we set tolerances and escalation thresholds from the start. Low or moderate risks are handled at operational level, high risks are analysed in project meetings and critical risks are escalated without delay to the appropriate decision-making level.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Every risk has an owner<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A list of risks without owners remains just a list. Every risk in the register has a designated owner, and response actions are assigned and tracked through to completion. Risks are reassessed periodically, because the context changes too: new systems, new vendors or new requirements appear.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is a clear action plan: what needs to be fixed, in what order, with what resources and within what timeframe. That is what turning technical information into clear decisions and concrete steps means.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Not all risks are equally important. A simple assessment on two axes \u2013 likelihood and impact \u2013 helps you separate what is critical from what is just a box to tick.<\/p>\n","protected":false},"author":1,"featured_media":2669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-2649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-risk-management"],"_links":{"self":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts\/2649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/comments?post=2649"}],"version-history":[{"count":1,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts\/2649\/revisions"}],"predecessor-version":[{"id":2657,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/posts\/2649\/revisions\/2657"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/media\/2669"}],"wp:attachment":[{"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/media?parent=2649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/categories?post=2649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dataeye.ro\/en\/wp-json\/wp\/v2\/tags?post=2649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}