Calling the CyberCops: Law Enforcement and Incident Handling

by Robert G. Ferrell Sept. 1, 2017 via Symantec

Corporate entities in a capitalistic economy are concerned primarily with profits, and only those actions which in some way enhance the ability of the organization to generate those profits are likely to be supported. Don't forget this simple maxim when you contemplate what actions to take following a system compromise. The urge for vengeance may be strong, but if it doesn't make sense fiscally, it probably ain't gonna happen (unless of course you own the company, but that's rather rare for a computer security manager. If you are the owner/CEO of the company, you can skip all this philosophical stuff and go straight to implementation. The rest of us will catch up to you there).

https://www.symantec.com/connect/articles/calling-cybercops-law-enforcement-and-incident-handling