An incident response team functions in much the same way a fire department does. Both teams take time to prepare themselves with training on their respective techniques, tools, and practices, and can respond at a moment's notice to a fire or incident. During their response to the fire, the firefighters take notes and record their actions, ensure that critical decisions are documented, and that individual contributions are noted. Once the fire is out, they sift through the debris to determine what the cause and origin were. Once the proper documentation has been prepared, the fire department conducts an after-action review to critique their performance and to find avenues of improvement. Other reports allow fire departments and safety experts to update building codes and improve the survival of structures should a fire break out.

Incident response teams utilize much the same workflow. During an incident, notes are taken and actions recorded. Evidence is obtained...