Which of the following should be the PRIMARY objective of the information security incident response process?