Follows preparation, identification, containment, eradication, recovery, communication, evidence preservation, and post-incident improvement for a realistic breach.