An incident response team requires documentation for an email phishing campaign against a company's email server. Which of the following is the BEST resource to use to start the investigation?

A. Audit and system logs
B. Change management procedures
C. Departmental policies
D. Standard operating procedures