Explain the purpose of preserving evidence and supporting documentation during incident resolution.

### The concept Evidence is information that can help explain an incident, while supporting documentation records relevant observations and response actions. Preserving these materials helps the team analyze what happened rather than relying only on memory. Recording the steps used to uncover and resolve the incident also supports later review, root-cause analysis, and identification of improvements. The material connects documentation to practical future value: responders can draw on prior mitigation measures and lessons to recover more quickly and effectively. ### What a good answer covers - States that evidence and records support incident analysis. - Explains that documentation preserves the steps taken during discovery and resolution. - Connects records to root-cause review and lessons learned. - Explains how prior records can support faster, more effective future recovery. ### Terms - **Evidence**: Information preserved to support analysis of what occurred during an incident. - **Mitigation measure**: An action intended to reduce the harm or effects of a threat. ### Remember Record what was observed and done so later analysis can build on facts rather than memory.