Tandem Diabetes interview question

How would you investigate a security incident [process]?