When refers to the timing aspect of an incident, which includes creating a timeline that helps in understanding the sequence of events and is crucial for analyzing the incident's progression and impact. 'Who' relates to the individuals involved or responsible, 'where' pertains to the location of the incident, and 'why' aims to delve into the reason or motivation behind the incident.
Learn More
AI Generated Content may display inaccurate information, always double-check anything important.
Why is a timeline important in incident response?
What are the key components of an incident timeline?
How does 'when' differ from 'who', 'where', and 'why' in incident reporting?