[Derrick Adams]

Carlos,

Nice summary! One thing I’m curious about: how would your team decide when to escalate an incident (minor vs. major) and who is allowed to speak to customers or the public? Also, do you include an evidence-handling step (saving logs, screenshots, cloud data) so forensics and legal can use it later?