When this work is useful
- A compromised account or suspicious activity may indicate a cyber incident.
- The affected systems, people or accounts are not yet clear.
- A potential personal-data breach needs a documented technical basis.
- A complex DSAR spans fragmented systems and data sources.
- Logging, retention or evidence handling is not ready for an incident.
- A post-incident review needs improvements someone actually owns.