Which of the following is MOST critical when creating an incident response plan?