Does your organization have a documented process for selecting incident response strategies that balance rapid recovery with investigation needs during active incidents?

Incident response often forces a trade-off between speed and insight, and reviewers want a documented process for choosing strategies that balance rapid recovery against investigation needs. For example, immediately shutting down compromised systems may stop an attack but destroy valuable forensic evidence, while allowing limited continued access under monitoring might reveal the attacker's methods and targets.

Evidence could include an incident response playbook that outlines decision criteria for different types of incidents, defining when to prioritize immediate containment versus extended investigation. The playbook should include decision trees or matrices that help incident responders determine the appropriate balance based on factors such as incident severity, affected systems, and business impact.