Skip to main content

Impact Rating

Under ISO/SAE 21434, the impact rating determines how severe the damage of a damage scenario is. It is one half of the risk; the other half comes from the attack feasibility.

Four categories, four levels

Each impact category gets its own rating: safety, financial, operational and privacy, S/F/O/P for short. The rating picks one of four levels: negligible, moderate, major or severe. A damage scenario can affect several categories at once; the standard defines no weighting between them.

The four categories are the defaults, not a ceiling. Further ones are allowed, for example for regulatory consequences or reputational damage. An organization may also use its own scales, as long as they can be mapped to the scales of the standard. What counts as major and what counts as severe needs defining once; after that, everyone sticks to it.

The standard allows a shortcut. If the rating in one category makes any damage in another category clearly less critical, you don’t need to analyse the other one further. The standard’s example: safety is rated severe, so financial is not analysed further.

Whose damage counts

The rating takes the perspective of road users. Annex H, for instance, lists a damage scenario in which the drivers of oncoming vehicles are blinded. These people never bought the car. They are still the yardstick.

The standard neither requires nor forbids further stakeholders such as the manufacturer, fleet operators or suppliers. If you include them, define the set of stakeholders once for the whole organization. Otherwise two TARAs use two different yardsticks, and their results can no longer be compared.

The HARA has a say in safety

Safety ratings are derived from ISO 26262-3. Table F.1 of the standard maps the safety criteria to its four levels, and you may reuse an existing evaluation from the HARA. That is why Annex H writes “Severe (S3)” for the front collision. For financial, operational and privacy, Annex F offers its own tables.

From rating to risk

Because each category gets its own rating, there are two ways to the risk. Either you determine a separate risk value for each impact rating. The standard allows this, which is why Annex H writes “S: 5” rather than just “5”. Or you combine all ratings into one impact level (IL), usually via the maximum. itemis SECURE forms the IL this way, grouped by category and stakeholder. Only this value meets the feasibility in the risk matrix and yields the risk value.

Our article on asset identification and impact rating explains why the impact rating is the most subjective step of the TARA, and what helps.

More on this topic

Related terms

Damage Scenario Risk Value Asset Attack Feasibility HARA

Frequently asked questions

From whose perspective is the impact rated?
From the perspective of road users. That includes people who never bought the vehicle, such as the drivers of oncoming cars. The standard neither requires nor forbids further stakeholders such as the manufacturer, fleet operators or suppliers.
Can you add your own impact categories?
Yes. Safety, financial, operational and privacy are the defaults, not a ceiling. If you want to see regulatory consequences or reputational damage separately, add a category. Organization-specific scales are allowed too, as long as they can be mapped to the scales of the standard.
How does the impact rating relate to the HARA?
Through the safety category. Safety ratings are derived from ISO 26262-3, and an existing functional safety evaluation may be reused. That is why Annex H writes Severe (S3) for the front collision: the ISO/SAE 21434 level, followed by the severity class from the HARA.
Reviewed by Jens Bühl, Product Owner on October 30, 2026