Select the single best answer. Preserve evidence provenance and time, test external reporting against the incident, and distinguish leads, observed facts, analytic judgments, and response decisions.