IEC 62443-3-2 Consequence | Automation Engineering Body of Knowledge

Consequence is the undesirable result of an incident — usually described in terms of health and safety effects, environmental impacts, loss of property and business interruption. In cybersecurity risk work it is often stated as the worst-case scenario if the threat occurs. Part 3-2 requires consequence and impact to be determined for each threat scenario in the detailed assessment (ZCR 5.3).

Teaching note: Summaries paraphrase ISA/IEC 62443-3-2:2020 and common IACS training material for learning. They are not a verbatim extract of the standard — always refer to the published text for normative wording and assessment.

Consequence vs impact

	Meaning	Example
Consequence	What undesirable thing happens	The consequence of the incident was a spill
Impact	Measure of the ultimate loss or harm associated with that consequence (injuries/fatalities, extent of damage, financial loss, IP loss, lost production, market share, recovery cost, and similar)	The impact of the spill was a $100,000 fine and $25,000 in clean-up expense

Part 3-2 language in ZCR 5.3 asks for both consequence and impact. Scoring usually lands on the organisation’s impact scale so results fit the corporate risk matrix (risk equation).

Assume no cybersecurity controls

When stating worst-case consequence for unmitigated risk, assume cybersecurity countermeasures are not in place (aligned with unmitigated likelihood in ZCR 5.4). That reveals inherent exposure before credit is taken for firewalls, access control, monitoring and similar measures. Non-cyber independent protection layers may still be recognised where the method allows.

Consequence categories

Categories are set by the asset owner / senior management so cyber risk ranks alongside other enterprise risk. Common categories include:

Health
Safety
Environment
Business continuity
Reputation
Information or intellectual property leakage
Other (financial, legal/regulatory, product quality, and similar)

Scenarios are typically scored per category, but only the highest category score is used in risk ranking for that scenario. Example consequence scales differ between organisations; reuse the scale already used for process hazards and enterprise risk wherever possible.

Where consequence sits in Part 3-2

ZCR 2 — worst-case unmitigated impacts (health/safety, environment, business interruption, and similar) to size the SUC stakes; draw on PHAs and functional-safety results.
ZCR 5.3 — consequence and impact per threat; low impact may mean moving quickly to the next threat.
Criticality assessment — AIC-style thinking for assets during initial/high-level risk work.

Key Takeaways

Consequence = what goes wrong; impact = how bad it is measured.
Score categories, then use the highest for ranking.
Unmitigated analysis assumes cybersecurity controls are absent; reuse organisational scales.