During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?

### The concept The four phases provide a structure for discussion, not a claim that every real incident follows a perfectly linear path. Discovery establishes what systems and data may be involved and starts organized documentation. Investigation examines the suspicious activity and possible control gaps. Response coordinates decisions, responsibilities, and communications. Recovery and compliance review consider audit readiness, monitoring, training, and improvements. Participants should base decisions on the information available at each point and record unresolved questions rather than inventing facts. ### What a good answer covers - Identify the payment systems and determine whether the firm stores cardholder data. - Investigate the personal-device access, alerts, logs, and possible control violations. - Clarify responsibilities and plan client communications and policy updates. - Include mock audit activity, continued monitoring, staff training, and risk improvements in the review phase. ### Terms - **Cardholder data**: Payment-card information whose handling is considered in the exercise's compliance assessment. - **Incident response**: The coordinated actions an organization takes to investigate and address a security incident. - **Vendor management**: Oversight of service providers and risks connected to their services. ### Remember Discovery establishes scope, investigation examines evidence, response coordinates action, and review converts lessons into improvements.