An IS auditor follows up on a recent security incident and finds the incident response was not adequate. Which of the following findings should be considered MO...