The sequenced handling of a security compromise: document, contain, rotate credentials, involve the host, restore clean onto updated software, verify, and log. The sequence exists because the instinctive responses destroy evidence. Strategic Web Management Ch. 8 (8.4)