After the occurrence of a major information security incident, which of the following will BEST help an information security manager determine corrective action...