When responding to a security incident, does your organization have a process to identify and examine other potential targets for indicators of compromise and evidence of attacker persistence?

During a security incident, attackers often compromise multiple systems or accounts to maintain access even if the initial entry point is discovered.

This question assesses whether your organization conducts lateral investigation beyond the initially identified compromised system to detect the full scope of the breach.

For example, if a server is compromised, your team should examine other servers in the same network segment, systems that share credentials, or systems that communicate with the compromised host.

Evidence could include an incident response playbook that documents the process for lateral investigation, logs showing examination of related systems during past incidents, or reports from previous incident investigations that demonstrate how other potential targets were identified and examined.