During a simulated cloud security incident response drill, the designated incident commander for \"Nebula Corp,\" a provider of SaaS solutions hosted on a multi-cloud environment, exhibits strong leadership by swiftly making a critical decision to isolate a suspected compromised segment of the production network, even though the exact nature and extent of the breach were not fully understood. This action, while potentially disruptive, was based on a rapid assessment of available telemetry and a prioritization of containment over immediate, complete understanding. The commander then effectively delegated tasks to the SOC team for log analysis and to the cloud infrastructure team for implementing the isolation, while simultaneously initiating communication with executive stakeholders about the evolving situation. Which of the following behavioral competencies is the internal auditor *most* likely focusing on evaluating through the incident commander\'s actions in this specific phase of the exercise, as per ISO 27017:2015 principles for cloud security auditing?