(2) The negative consequence of an actualized threat is harm. Degree of harm evaluates the potential consequences on the system when the threat is successfully carried out. Degree of harm identifies three categories of a threat: low, medium and high. A threat is ranked as critical if it is likely and has high or medium potential impact.