A System Owner (SO) is implementing a new system with their existing organization Information Technology (IT) environment. What objectives are considered when determining possible impact to risk?…

Low, Moderate, and High are impact levels, not the underlying objectives used to determine that impact.

Authentication, Authorization, and Accountability (AAA) are security services or principles related to access control and user management, not the primary impact objectives for risk.

Common, Hybrid, and System-Specific refer to types of security controls based on their inheritance or scope, not risk impact objectives.

The core objectives considered when determining the impact of a security event on risk are Confidentiality, Integrity, and Availability (CIA). The potential loss or compromise of any of these three properties defines the adverse effect, which then determines the impact level (low, moderate, or high).