The first decision point of an incident investigation is Detection. Before any steps such as preparation or verification can be undertaken, the incident must first be detected. Detection is the initial phase that triggers the subsequent investigation process.