During an incident investigation, which activity is performed after containing the event?

• A. Interview involved parties
• B. Contain the event
• C. Identify root causes
• D. Implement corrective actions

Answer: (A)

After containing the event, the next essential activity is interviewing the people involved. This step gathers firsthand accounts from those who observed or participated in what happened, providing details that records or automated logs may miss. By talking with involved parties, you establish the timeline, confirm facts, and surface contributing factors or conditions that influenced the incident. This information is crucial for building an accurate picture of events and for guiding subsequent analysis.

Containment stops further impact and preserves evidence, so it happens first. Root-cause analysis relies on the facts gathered from interviews and other data, and implementing corrective actions follows once those root causes are identified and understood.