A tech company rapidly expanded its operations over the past few years. Its information system, consisting of servers, databases, and communication…

The scenario describes a situation where the company's information system (servers, databases, communication tools) cannot handle the operational load, resulting in saturation. This is a classic example of an infrastructure failure. The threat is the inability of the technical infrastructure to meet performance and capacity demands due to rapid growth. Threat taxonomies used in information security risk management, aligned with ISO/IEC 27005, categorize the failure of hardware, software, and network resources to provide the required level of service as an infrastructure or equipment failure. The saturation is the manifestation of this failure, which is the direct cause of the resulting downtime and slow performance.

B. Technical failures: This term is too broad. While an infrastructure failure is a type of technical failure, the option "Infrastructure failures" is more precise and specific to the described scenario of systemic capacity exhaustion.
C. Compromise of functions: This describes the consequence or outcome of the threat (e.g., slower response times, downtime), not the threat category itself. The infrastructure failure is the root cause.

1. PECB. (2022). ISO/IEC 27001 Lead Implementer Training Course. In the Risk Management module, threat categorization is discussed. Failures related to system capacity, resource exhaustion, and hardware/network saturation are typically classified under "Equipment Failure" or "Infrastructure Failure," which are considered types of technical threats.

2. ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection — Guidance on managing information security risks. Annex A, Table A.1 provides examples of typical threats. The scenario falls under the main category of "Technical failures," specifically relating to "Equipment failure" (e.g., servers reaching capacity limits) and "Communications failure" (e.g., network saturation). "Infrastructure failures" is a common, practical term for this grouping.

3. Peltier, T. R. (2016). Information Security Risk Analysis (3rd ed.). Auerbach Publications. Chapter 4, "Risk Analysis Methodologies," discusses threat identification and categorization. Threats are often grouped into categories such as natural, human, and technical/environmental. Failures of hardware, telecommunications, and supporting utilities due to exceeded capacity are classified as technical or infrastructure-related threats. (DOI: https://doi.org/10.1201/9781439839487)