An incident  is an event that results in an actual or threatened violation

An incident  is an event that results in an actual or threatened violation of security policy.  When an incident occurs, an organization needs to respond.  The incident-handling process consists of the following steps: Preparation, Identification, Notification, Response, Recovery and follow-up, and Documentation.  

If you were tasked with handling an incident, which step would need the most help with, and where would you get the help to do it right?  Explain how you came up with your answer.