Determining the scope of the incident involves identifying who was affected. Were customers, subscribers, or internal staff impacted? Knowing the affected parties aids in prioritizing response efforts and tailoring communications to address specific concerns.