The policies and procedures for what to do if certain business resources or data are under attack. These policies and procedures are for mitigating loss and improper access. Often, logs and data should be acquired for computer forensics.