CHRONOLOGY

his document is at the "containment, eradication and recovery" part of the incident lifecycle.

This means that detection and analysis has already begun and has identified (at least) a portion of the impacted perimeter.