So that very different kinds of impact can be weighed on a common footing, the organization should set impact types and criteria, approved by top management, that express how a disruption to delivering products and services would hurt it as time passes. Impact types differ from the consequence categories used in risk management. Which ones are chosen depends on the sector, the context, the kind of activities and the culture, and the choice, including whether quantitative and qualitative data are both needed and how much detail is wanted, should fit the task of choosing or justifying priorities and requirements. Possible impact types cover financial, operational, reputational, market share, environmental, health and safety, business objectives, and legal, regulatory and contractual impact; they may be merged, for example into four groups: reputational; financial; business objectives; and legal, regulatory and contractual. The organization may set thresholds beyond which impact is unacceptable (Table 2), or build an impact matrix giving criteria for each type at each level (Table 3, five levels that can be adapted), keeping the criteria as objective and measurable as it can.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.