Once the high impact systems and applications have been defined, scanned, and reported on, we can then begin to increase the reporting scope with the scanning scope by adding the medium impact items. By communicating what is high and medium impact, the stakeholder on the ground that is responsible for mitigating the risk (again) has a basis of prioritizing their workload: