A third-party assessment of a recent incident determined that the incident response team spent too long trying to get the scope needed for the incident timeline...