Once they have access, they have gained a “foothold,” and using this foothold the attacker then may move around the network of users at this same lower level, gaining access to information of this similar privilege.[32] Analyzes and assesses damage to the data/infrastructure as a result of security incidents, examines available recovery tool