Incident response and investigation procedure