After successfully isolating the affected systems, the next step is to assess the impact of the incident to understand the extent of damage, potential data loss, or service disruption. This helps prioritize recovery efforts and allocate resources where they are needed most. Assessing the scope might help understand the breadth of the incident but does not directly measure the severity of the consequences. The eradication phase comes after understanding the impact and successfully containing the incident. Gathering more evidence would be part of the detection and analysis phase, specifically when identifying the cause and nature of the incident rather than evaluating its impact.