Examine the "five steps" to the evidentiary process if the incident caused a severe outage. How does this process grain against the impulse of the IT Manager or Contingency Plan Coordinator? How does the Cyber Incident Response Plan (CIRP, NIST SP800-34) address this problem?