The steps in IR are designed to:

Question $30$ options:

A$)$

stop the incident, mitigate incident effects, provide information for recovery from the incident

B$)$

control legal exposure, avoid unfavorable media attention, and minimize impact on stock prices

C$)$

delay the incident progress, backtrack the attack to its source IP$,$ and apprehend the intruder

D$)$

stop the incident, inventory affected systems, and determine appropriate losses for insurance settlement