Review should include accessing and examining security and all system logs.