SANS Incident Handler's Handbook and PICERL Methodology P-d: P-d Document every action taken so records answer who, what, when, where, why and how

The team records everything it does (commands typed, systems touched and similar) so the record can say who acted, what was done, when, where, why and how, both as evidence if the incident proves criminal and as the basis for lessons learned; checklists with space for notes, dates and times following each response step are recommended.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Phase 1: Preparation – SANS Incident Handler's Handbook and PICERL Methodology

P-a P-a Written security policy that tells staff what is expected and lets the team judge whether an incident occurred
P-b P-b Incident response plan that ranks incidents by organizational impact
P-c P-c Communication plan: who the team contacts, when and why, including when to involve law enforcement
P-e P-e Multidisciplinary response team including legal, HR, public relations and IT specialists
P-f P-f Response team can be granted the permissions it needs during an incident and have them removed afterwards
P-g P-g Ready tools in a jump bag: journal, contact list, bootable media, forensic laptop, tool kits, write-blocking duplicators
P-h P-h Regular drills so every team member knows and can perform their duties

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SANS Incident Handler's Handbook and PICERL Methodology controls