As a security professional, I have seen a wide variety of best practices for incident response. The methodologies vary greatly based on the sensitivity of the data, requirements to notify law enforcement, and to ownership of the services from third parties, on premise, technologies or to hosted in the cloud.