Escalation and Reporting

Section 7:

7.1 Notify Stakeholders

• PowerShell: Send-MailMessage -To "[e-mail]" -Subject "Incident 2025-02-25"

7.2 Secure Evidence

• BitLocker: manage-bde -on E: -RecoveryPassword 123456-789012-...

7.3 Handoff

• Log: “02/25/2025 15:30 EST – Evidence to IR Lead.”