A prepared team and process that detects, contains, eradicates, and recovers from security incidents while preserving digital evidence for analysis.