Why should organizations classify incidents by severity?

• A.To decide what the QSA must be told about, assign blame to the responsible department, set the fine amount, and calculate the insurance premium for the next year
• B.To rank incidents by the cost of the affected servers, schedule patching windows, and order replacement hardware
• C.To determine the appropriate level of response, resource allocation, escalation, and notification requirements based on the potential impact on cardholder data
• D.To determine what card brand receives the report, choose the PFI, and set the date of the next assessment