SC-200 - Manage incident response - Perform evidence and entity investigation