After policy, the organization writes a plan and strategy for handling incidents, prioritizing incident types by their impact on the organization (for example one broken workstation low, a server outage with failover moderate, theft of confidential HR data high); impact-based prioritization is also the argument for management support, without which the response team will lack resources.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.