Incident Response
Support the response without losing the record.
Plan preservation alongside containment and recovery so the investigation has the best available evidence.
01
Identify evidence priorities.
Discuss the suspected event, affected systems and records that may help establish the sequence. Evidence priorities should inform—not blindly override—urgent operational and safety decisions.
02
Coordinate collection and action.
Agree who is collecting which sources and who is changing the environment. Record actions already taken and the reason for them so that the examination can interpret the resulting records.
03
Keep handling understandable.
Document collection and transfer, and use agreed channels for evidence. Avoid scattering sensitive exports across informal messages and personal storage.
RELEVANT SOURCES
Start with what is available.
Discuss the sources that can help answer the question, within an authorized scope.
Relevant devices and account recordsBEFORE WE BEGIN
A more useful first conversation.
- Identify actions already taken.
- Nominate technical contacts.
- Discuss access and collection constraints.
RELATED ARTICLES
Useful before you need us.
Practical perspectives and clear next steps.
YOUR NEXT STEP
Bring clarity to the response.
Tell us what you need to understand.