Does your organization have a documented process for reconstructing the chronological sequence of security incidents, including all affected assets and resources?

Reconstructing what happened and when is the concern here, specifically whether you have a documented process to rebuild the chronological sequence of an incident across all affected assets. Proper incident timeline reconstruction helps identify which systems were compromised first, how the attack propagated through your environment, and what data or resources may have been accessed or modified during each phase of the incident.

Evidence of fulfillment could include incident response playbooks with timeline reconstruction procedures, sample incident reports showing chronological analysis, tools used for log correlation and timeline visualization (such as SIEM reports or forensic analysis outputs), or documentation from a previous incident showing the sequence of events with affected assets clearly mapped.