Orgs: Anything non-profit with publicly stated EA goals, size 2 > FTE for at least one year.

Incidents: resolves to yes for reports of actual damage - e.g., loss of data, reputational damage, non-trivial downtimes. Does not resolve for stuff like "employee downloaded ransomware, got only their laptop encrypted".

Public knowledge: A credible report available anywhere on the internet without login.