Figure 4.15 The Expanded Incident Lifecycle