CompTIA SecurityX (CAS-005) CAS-005 — Question 153

After an incident response exercise, a security administrator reviews the following table: Which of the following should the administrator do to best support rapid incident response in the future?