Man-Made Threat

Undersager

Sagslinks
Civil or Political Unrest Civil disturbance, protest activity, political instability or related violence that can restrict personnel or facility access, disrupt transportation and utilities, damage assets, interrupt suppliers or otherwise impair control execution.
Malicious Cyber Activity Deliberate malicious cyber activity, including exploitation, malware, credential abuse, denial-of-service, social engineering or other attack techniques, that can disable, bypass, manipulate or otherwise impair controls and their supporting technologies.
Hazardous Materials Emergencies An accidental release, spill, leak, fire, explosion or other hazardous-materials event that can endanger personnel, require evacuation, damage facilities or interrupt operations and control-supporting infrastructure.
Nuclear, Biological and Chemical (NBC) Weapons Intentional use or release of chemical, biological, radiological or nuclear agents that can cause casualties, contamination, evacuation, infrastructure disruption and prolonged loss of access to facilities or resources needed for control execution.
Physical Crime Physical criminal activity that results in unauthorized entry, theft, vandalism, sabotage or damage to facilities, equipment, records or other assets needed for control execution.
Terrorism & Armed Attacks Terrorist activity, active-assailant events or other armed attacks that can cause casualties, facility damage, evacuation, loss of access, infrastructure disruption or interruption of control-supporting operations.
Utility Service Disruption Sustained or material loss or degradation of electricity, water, natural gas, telecommunications, internet connectivity or other utility services required to operate facilities, technologies or controls.
Dysfunctional Management Practices Management interference, direction, override or other intentional circumventions that prevents established controls from being performed, enforced, monitored or escalated as designed.
Human Error Unintentional action or omission by personnel, contractors or other authorized users that misconfigures, disables, bypasses, damages or otherwise impairs a control or its supporting technology, process or data.
Technical / Mechanical Failure Non-malicious failure, degradation or malfunction of hardware, software, communications, mechanical equipment or supporting infrastructure that causes a control to become unavailable, unreliable or ineffective.
Statutory / Regulatory / Contractual Change A change in applicable laws, regulations, government directives or contractual obligations that invalidates existing assumptions, requires different safeguards, restricts technologies or suppliers, or otherwise causes established controls to become insufficient or inoperable.
Data Quality Degradation / Data Poisoning Use or introduction of inaccurate, stale, corrupted, incomplete, manipulated or otherwise untrustworthy data that causes controls, analytics or automated decisions to operate incorrectly or ineffectively.
Artificial Intelligence & Autonomous Technologies (AAT) System Failure or Unintended Behavior Non-malicious failure, malfunction, hallucination, unsafe output, goal misalignment, unintended autonomous action or other erroneous behavior by Artificial Intelligence & Autonomous Technologies that impairs a control or dependent business process.
Fraud, Corruption and/or Intentional Criminal Conduct Intentional criminal or corrupt conduct by an insider, third party or other actor that can bypass, manipulate or disable controls (e.g., fraud, bribery, theft, embezzlement, extortion or deliberate policy circumvention).
Conflict of Interest (COI) / Undue Influence / Insider Misconduct A Conflict of Interest (COI) or improper influence that causes a person with authority or access to make biased decisions, circumvent safeguards, conceal issues or otherwise impair objective control execution.
Economic Shock / Market Disruption Material economic instability, recession, inflation, interest-rate or exchange-rate shocks, commodity volatility or similar macroeconomic conditions that disrupt staffing, suppliers, investment or resources needed to sustain control execution.
Foreign Ownership, Control, or Influence (FOCI) Foreign Ownership, Control or Influence (FOCI) that is used to shape decisions, compel access, redirect operations or obtain sensitive information in a manner that can bypass or undermine organizational or supply-chain controls.
Geopolitical Conflict / Government Intervention Political conflict, government intervention, war, civil instability, nationalization, export restriction or other geopolitical action that disrupts suppliers, infrastructure, communications, access or resources required for control execution.
Sanctions / Trade Restriction Disruption Imposition, expansion or enforcement of sanctions, export controls, exclusions or trade restrictions that removes or constrains access to suppliers, technologies, services, personnel or financial channels required for control execution.
Counterfeit / Non-Conforming Products Counterfeit, substituted, defective or non-conforming components, materials, software or services enter the supply chain and cause control-supporting products to perform unpredictably, fail prematurely or operate outside required specifications.
Hazardous / Degraded Operational Environment Environmental, physical or operating conditions at the place of performance that exceed design assumptions or safe operating limits and degrade personnel, equipment or processes needed for control execution.
Manufacturing Capacity / Supply Disruption Loss, reduction or delay of manufacturing capacity, materials, components or supplier output that prevents timely availability of products or services required for control execution (e.g., sole-source or concentration failures).
Product Defect / Design Failure A design flaw, manufacturing defect, quality failure or specification deviation in a product or service that causes unsafe, unreliable or ineffective operation of a control or its supporting technology.
Supplier Financial Distress / Insolvency Financial distress, loss of liquidity, hostile acquisition, bankruptcy or insolvency of a critical supplier that interrupts contractual performance, support, maintenance or delivery of control-dependent products or services.
Workforce Shortage / Loss of Critical Skills / Labor Disruption Loss, shortage, unavailability or labor disruption of personnel with required knowledge, skills or authorization that prevents controls from being performed, maintained, monitored or recovered as intended.
Transportation / Logistics Disruption Accident, cargo loss, carrier failure, route closure, capacity shortage or other transportation or logistics disruption that delays or prevents delivery of products, equipment or services needed for control execution.
Infrastructure Failure / Degradation Failure, degradation or unavailability of transportation, communications, energy, facilities or other foundational infrastructure on which the organization or its supply chain depends for control execution.
Harvest Now / Decrypt Later (HNDL) A threat actor intercepts and retains currently encrypted sensitive information with the intent to decrypt it later when cryptanalytic or quantum capabilities make the deployed cryptography vulnerable.
Adversarial Artificial Intelligence (AI) Attack Deliberate manipulation or exploitation of an AI system through adversarial inputs, prompt injection, jailbreaking, data or model poisoning, model theft, inference attacks or related techniques that bypass, alter or impair controls or AI-dependent functions.
Operational Technology (OT) / Industrial Control System (ICS) Attack Deliberate cyberattack against Operational Technology (OT) or Industrial Control System (ICS) environments that manipulates, disrupts or disables industrial processes, safety functions, equipment or control-supporting operations.
Cryptographic Compromise / Cryptanalytic Capability Advancement Advances in computing, cryptanalysis or attack techniques reduce the effective security of deployed cryptographic algorithms or key sizes, causing cryptographic controls to provide less protection than intended.