Why is evidence preservation important during incident response?

• A.Preserved evidence satisfies the QSA assessment, lets the acquirer set the fine amount, proves the merchant was compliant, and may be required by the issuing bank for chargebacks
• B.Preserved evidence replaces the need for log retention, allows the PFI to skip interviews, speeds up the card brand review, and may reduce the assessment fees charged to the merchant
• C.Preserved evidence supports forensic investigation, helps determine the scope of compromise, meets legal requirements, and may be needed for law enforcement proceedings
• D.Preserved evidence is used to rebuild servers, restore backups, verify patches, and may be needed by the ASV for rescans