Refer to the exhibit.

Define and build the incident response team

Monitor incidents and tune the policy to reduce false positives

Establish business metrics and begin sending reports to business unit stakeholders

Test policies to ensure that blocking actions minimize business process disruptions