A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident…

Researching attacker motives and classifying information criticality are threat intelligence activities that occur during later analytical phases, after evidence has already been secured.

Determining the damage to the business establishes incident severity and drives escalation decisions at the earliest stage of response. Extracting logs and reports captures volatile evidence before it is overwritten or lost, which is critical when software changes are the indicator of compromise. Maintaining a chain of custody from the moment evidence is collected ensures its integrity is preserved for any forensic investigation or potential legal proceedings.

Classifying the attack vector, understanding scope, and identifying vulnerabilities are deeper analysis tasks performed after initial evidence preservation and damage assessment are completed.

Determining the attack surface and evaluating risks are strategic activities associated with preparation and post-incident review phases, not the immediate triage actions taken when an incident is first detected.