During an incident, the team should follow these steps:
Identify the source and nature of the incident. Isolate affected systems to prevent further damage. Document all actions taken and evidence collected. Communicate with stakeholders and regulatory bodies as needed. Analyze the incident to understand its impact and cause.