Impact metrics

- Incidents by type and severity - Data records affected (if any) - Financial impact (response cost, business cost) - Customer impact (notifications, churn) - Regulatory notifications (timeliness)