Because how hard an information security incident hits depends on context, including the entity's role in society and democracy, its governance style and its relationship with citizens, determining impact must cover at least these areas: political damage to a member of the board; diplomatic damage; financial consequences; direct harm to the public image of the entity; the public's respect or trust lost; negative publicity hitting the organisation as a whole; a significant loss of motivation among employees; and a major loss of management control. These areas also support clear communication with chain partners.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.