A process owner's impact estimate excludes customer compensation required by contract. What should the practitioner do?

1. Ignore contracts because they are not technical controls
2. Include the relevant contractual consequence and document the basis
3. Automatically assume the maximum imaginable compensation
4. Use only hardware replacement expense