Which of the following steps of incident response does a team analyze the incident and determine steps to prevent a future occurrence?