When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?