In the cybersecurity incident case study template, which practice best protects the credibility of the analysis?

### Why this is right The template directs writers to support factual claims with citations, distinguish verified facts from interpretation, and avoid claiming access to evidence they have not examined. This makes the analysis traceable and appropriately cautious. ### The concept A case study is an evidence-based explanation of an incident, not an invented reconstruction. Writers should prefer original disclosures, official investigation findings, and relevant professional sources. Reported figures should be labeled as reported or estimated, and unavailable details should be identified as not publicly reported. A timeline should distinguish incident occurrence from discovery. These practices make uncertainty visible rather than disguising it. ### The other options - **B. Treat every media estimate as a confirmed official figure**: Estimates and official findings have different evidentiary status. - **C. Infer missing dates from the order of news reports**: Publication order does not establish event timing. - **D. Claim to have examined logs when only public reports were used**: This misrepresents the evidence available to the author. ### Terms - **Primary source**: An original disclosure, record, or investigation account from a direct source. - **Interpretation**: An analytical conclusion drawn from evidence rather than a directly reported fact. ### Remember Cite what is known, label what is inferred, and disclose what is unavailable.