Next steps: Incident response and evidence

Build an evidence ledger, not a narrative

In a live incident, each statement must sit in one of three lanes: Observed fact: a preserved artefact shows a defined event. Inference: the event probably means something, subject to stated assumptions. Legal conclusion: the established and provisional facts meet, or may meet, a regulatory test.

Visual: a three-lane board. Put object-store audit shows a retrieval event in the fact lane; a document was probably retrieved in inference; unauthorised access may be a personal data breach in legal assessment. Do not silently move an inference into the fact lane because a report is due.