Risk Assessment Impact Categories for CIA

When conducting infosec risk assessments, we're struggling with evaluating the impact of the risk/threat in question on confidentiality, integrity and availability, respectively.

Looking for a ressource or similar providing inspiration for defining impact categories (i.e. low, medium, high etc.) for each of the CIA areas - similar to those that states that "high impact equals cost of 2M" - How does one define what "high" impact to confidentiality etc. equals?


Thanks!

assessment cia cybersecurity impact risk risk assessment