What happens before, during and after a cyber incident?