What is the correct order of steps for an incident process?