Which of the following is MOST important when prioritizing an information security incident?

A. Organizational risk tolerance
B. Cost to contain and remediate the incident
C. Critically of affected resources
D. Short-term impact to shareholder value