Establish the original evidence
Record the authorised scenario, affected assets, observed activity and expected outcome before changing the environment.
- Separate observed facts from inference
- Preserve the relevant event sequence
- State what the test cannot establish
