What is the first and most important step What is an IR reaction strategy? If an organization chooses the protect and forget instead of the apprehend and prosecute philosophy, what aspect of IR will be most affected? What is the first task the CSIRT leader will undertake on arrival? What is the second task the CSIRT leader will undertake? What is an incident damage assessment? What are some of the reasons a safeguard or control may not have been successful in stopping or limiting an incident? What must be done with interrupted services during the recovery process? What procedures should occur on a regular basis to maintain the IR plan? in preparing for DoS and DDoS attacks responses