the attackers are detected and stopped

there is minimal disruption to the organization’s mission

appropriate documentation about the event is maintained as chain of

evidence

the affected systems are immediately shut off to limit to the impact