SANS Incident Handler's Handbook and PICERL Methodology I-2: I-2 Notify the team, coordinate with a command centre, assign a primary handler plus a second handler, and document

Once an incident is identified, team members are notified and coordination is set up with designated command centre staff such as management and system administrators; at least two handlers should be available, one as primary handler assessing the incident and one gathering evidence; communication with management matters most where business operations are affected; everything done is documented to the same standard as in preparation (who, what, where, why, how) before moving on to containment.