What is accomplished in the identification phase of incident handling?

What is accomplished in the identification phase of incident handling?
A . determining the responsible user
B . identifying source and destination IP addresses
C . defining the limits of your authority related to a security event
D . determining that a security event has occurred

Answer: D