Which of the following is MOST important when prioritizing an information security incident?