Planning for an incident is critical. Equally critical is properly managing an incident. This involves several elements that each CSIRT must address during the life of an incident. Proper logistics provides the necessary elements for the CSIRT to function. Having strategies to communicate incident information to leadership, third parties, and customers keeps those stakeholders informed, lessens speculation, and ensures compliance requirements are met. Incident investigation allows the CSIRT to properly identify the attack, identify the scope, and limit damage via a proper containment strategy. Finally, these elements are all part of eradicating an adversary's ability to access a network and helping an organization to return to normal. As was stated at the beginning: Everyone has a plan until they get hit in the face. The real value of a CSIRT to an organization is not in the plans and playbooks, but in how well they execute when an incident occurs. The following chapter will expand on the incident investigation portion of incident management, by providing the digital forensics framework to which CSIRT personnel adhere.