after an incident occurs, the incident response policy should be used as a guideline for actions taken. different steps need to be performed to properly document and correct the incident. which of the following are phases from an incident response plan?