What falls under the evolution (investigation) stage?

A) Incident detection and reporting
B) Incident containment and eradication
C) Legal actions and law enforcement involvement
D) Incident preparation and response planning