After discovering a security incident, what is the second recommended step?

• A. Contain the incident
• B. Preserve evidence
• C. Notify supervisor/CSIRT
• D. Document details

Answer: (B)

Preserving evidence is the key step to take after you’ve contained the incident. Once you’ve stopped the spread or further damage, you need to secure artifacts that will allow the investigation to proceed reliably. This means creating and safeguarding logs, disk images, memory captures, and network traffic data, while maintaining a strict chain of custody so the data stays admissible and trustworthy. If data is altered or logs are cleared, you lose the ability to reconstruct what happened, who was involved, and when it occurred. Preserving this evidence supports root-cause analysis, potential legal or regulatory actions, and informs how to recover and prevent recurrence. Notifying the supervisor or CSIRT and documenting what happened are important steps too, but they’re most effective once evidence has been preserved so the response team has solid information to work with.