Does your organization have a documented process for selecting incident response strategies that balance rapid recovery with investigation needs during active incidents?

This question assesses whether your organization has a formal approach to incident response that considers both the urgency of restoring operations and the potential value of monitoring attacker behavior or conducting thorough investigations. For example, immediately shutting down compromised systems may stop an attack but destroy valuable forensic evidence, while allowing limited continued access under monitoring might reveal the attacker's methods and targets. Evidence could include an incident response playbook that outlines decision criteria for different types of incidents, defining when to prioritize immediate containment versus extended investigation. The playbook should include decision trees or matrices that help incident responders determine the appropriate balance based on factors such as incident severity, affected systems, and business impact.