Handle a security incident
Security and data protection: Handle a security incident. Starts when: Incident detected. Steps: Contain; Investigate; Evidence preserved; Lessons; Record. Done when: Incident record has containment time and root cause. Rules that apply: FCA SYSC 15A; NCSC.