Your system was breached. Time is critical. What do you do?
Incident response starts before the incident occurs. In order for the incident to be handled efficiently, policies must be implemented to ensure that staff members are able to identify when an incident has occurred and who should be contacted.
When the incident does occur, it is important that the appropriate persons are contacted immediately. If untrained individuals are allowed unchecked access to the scene, crucial information, or even potential evidence could be lost.