Which of the following provides the MOST relevant evidence of incident response maturity?