Arrange the following four incident management phases in chronological order, from initial identification through post-incident activities: Investigation, Recovery and compliance review, Discovery, Response.

### The order 1. **Discovery**: Participants first identify the incident, payment systems, and potentially involved data. 2. **Investigation**: They analyze suspicious access, alerts, logs, and possible control gaps. 3. **Response**: They coordinate responsibilities, client communications, and policy actions. 4. **Recovery and compliance review**: They conduct post-incident review, practise audit readiness, monitor, train, and plan improvements. ### The concept The phase sequence structures the exercise from recognition through learning and improvement. It helps participants distinguish identifying a concern from analyzing its causes, coordinating a response, and reviewing what should change afterward. In practice, organizations may revisit earlier questions as new information emerges, but the exercise presents these phases in this order. ### Terms - **Compliance review**: A review of requirements, evidence, and gaps related to compliance. - **Recovery**: Post-incident work focused on restoring and improving organizational readiness. ### Remember Move from identifying the event to examining it, coordinating action, and reviewing improvements.