Question

Following the successful eradication and recovery from a data breach, the incident manager is preparing to close the incident. Legal counsel has just advised that litigation involving the breach is reasonably anticipated. What should the incident manager ensure is done BEFORE proceeding to formally close the incident?

Accepted Answer

Apply a legal hold to preserve all relevant evidence and logs according to defined retention requirements

Answer

Delete all forensic images to reduce storage costs once recovery is confirmed

Answer

Publish the full incident report externally to demonstrate transparency

Answer

Immediately restore normal log rotation and purging to free up system resources