Watch this video on YouTube
What is the main thing taken into account when common controls protect multiple organizational systems of differing impact levels?