When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the: