Response: The response phase is when the incident response team begins interacting with affected
systems and attempts to keep further damage from occurring as a result of the incident. This can be
taking a system off the network, isolating traffic, powering off the system, or however our plan
dictates to isolate the system to minimize both the scope and severity of the incident. Knowing how
to respond, when to follow the policies and procedures to the letter and when not to, is why we have
senior staff handle the responses. We make bit level copies of the systems, as close as possible to
the time of incidence to ensure they are a true representation of the incident.