A service desk analyst is handling two simultaneous incidents. Incident 1 affects a single user who cannot access a non-critical reporting dashboard. Incident 2 affects the online payment system, which is completely down during a major sales event, blocking all customer transactions. The analyst must decide which to work on first. On what basis should incident management prioritize these incidents?