Why is evidence preservation important during incident response?

• A.To satisfy auditors, since business continuity documentation satisfies the incident response requirements for Level 1 merchants once a targeted risk analysis is on file
• B.To blame the attacker, which v4.0 supports by making the acquiring bank the first responder for merchant breaches, with the merchant's own duties beginning only after the acquirer's investigation closes
• C.Preserved evidence supports forensic investigation, helps determine the scope of compromise, meets legal requirements, and may be needed for law enforcement proceedings
• D.For media coverage, because the standard permits the incident response plan to omit forensic evidence handling for SAQ A-EP merchants during the semi-annual rule review