Which of the following actions should occur to address any

open issues while closing an incident involving various departments within the network?

A. Incident response plan

B. Lessons learned report

C. Reverse engineering process

D. Chain of custody documentation