organizations use a(n) to categorize a security threat, determine its cause, preserve any evidence, and get systems back online so they can resume business.