Hashing ensures integrity of software by detecting any unauthorized changes or tampering after its final version.

A playbook is a documented set of procedures that outlines the step-by-step response to specific types of cybersecurity incidents. Security Operations Centers (SOCs) use playbooks to improve consistency, efficiency, and accuracy during incident response. Playbooks help ensure that the correct procedures are followed based on the type of incident, ensuring swift and effective remediation.
Frameworks provide general guidelines for implementing security but are not specific enough for incident response procedures.
Baselines represent normal system behavior and are used for anomaly detection, not incident response guidance.
Benchmarks are performance standards and are not directly related to incident response.

Packet capture data can be very large and may not need to be stored for extended periods compared to other logs essential for security audits.

The acquisition phase involves creating forensic images (exact replicas) of storage devices or memory to ensure data integrity for further analysis.