Incident investigation, evaluation and evidence handling

Once an incident is confirmed, investigation establishes what happened, how, when, which systems and data were affected, and whether the attacker is still present. Evaluation uses those facts to assess business impact, confirm or change severity, and guide containment, notification and recovery decisions. Good investigation answers the questions management, regulators and customers will ask, and it identifies the root cause so the incident does not recur.