An incident is an event that results in an actual or threatened violation of security policy.For example, the Medibank system in Australia was hacked last week and the private health data of millions of customers is being sold on the dark web, leaving customers prone to extortion. Presumably the Australian authorities would have taken the following steps: Preparation, Identification, Notification, Response, Recovery and follow-up, and Documentation.

If you were handling an incident response, which step would need the most help with, and where would you get the help to do it right? Explain how you came up with your answer