As a part of incident response, which action should be performed?

A.
watch to see if the incident reoccurs

B.
custody of information

C.
maintain data security and custody for future forensics use

D.
classify the problem