Order · Domain 4

Put the incident response steps in order

At 2 a.m. the monitoring tool at Harbor Lane Clinic flags files being encrypted on two front-desk PCs. The on-call engineer opens the incident plan the clinic wrote last spring. Put its phases in the order the plan follows, from before the incident to after it.