you are helping your organization create a security policy for incident response. which of the following choices is the best choice to include when an incident requires confiscation of a physical asset?