Compare and contrast the Unauthorized Use vs. Inappropriate Use categories of incidents and how they should be handled. What key elements do you see that argue for different sets of procedures (such as checklists) that a CSIRT should use?
How should the choice of containment and eradication responses be made? Who should make this decision? What should this decision effect or cause to happen?