At what point in the Incident Handling process should an organization determine its approach to notifying law enforcement?

Analysis is a later phase focused on understanding what happened, not on deciding organizational response procedures like law enforcement notification.

Policy preparation establishes general guidelines but does not produce the situational judgment required to determine the actual notification approach for a specific incident.

Recovery is a late-stage phase aimed at restoring operations; deciding to involve law enforcement at this point may compromise evidence and violate legal timelines.

During the reaction phase of incident handling, the team assesses the incident's severity, scope, and legal implications, which provides the concrete details needed to determine whether law enforcement should be notified. Factors such as the type of crime, jurisdictional requirements, and potential evidence preservation needs can only be properly evaluated once the incident is underway. Making this determination reactively, with actual incident data in hand, ensures the decision is appropriate to the specific situation.