Most of the focus on incident response revolves around getting a system back into production as quickly as possible. The IT worker responding to an incident must be aware of what data that user has access to, and whether or not the data could be stored on that machine. End users must be educated about their responsibilities to keep certain types of corporate data secure. It’s no easy task, but it could mean long-term success or short-term failure due to leaked data. Find out where and how your sensitive data is being used!”]
Source: https://www.darkreading.com/attacks-breaches/incident-response-means-knowing-your-data