the most stringent baseline, because a compromise or outage could result in "severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals."