An impact estimate counts only the direct loss of availability from an outage. Which two consequences does IR 8286 warn this omission produces? Choose two.

Answer: C. The total impact of the scenario is understated
D. Risk response selection and prioritisation are misinformed

IR 8286 states secondary loss events should be captured with primary loss events, because omitting secondary losses would underestimate the total impact and thereby misinform risk response selection and prioritisation.

Source: NIST IR 8286 (NIST) — Sec. 3.3.2 Techniques for Estimating Likelihood and Impact