Which of the following is the MOST important part of an incident response plan?