Domain 1 of 4 · Chapter 2 of 3

Explain the incident response process

Unlock the complete study guide.

Bundled into the existing CompTIA CySA+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Seven incident response phases, seven questions
  • How the phases map to NIST SP 800-61 Rev. 2 and Rev. 3
  • Preparation: readiness built before the alert
  • Detection: noticing potentially adverse activity
  • Analysis: from signal to declared incident and scope
  • Containment: stopping the incident from expanding
  • Eradication: removing the compromise and its footholds
  • Recovery: returning services to verified operation
  • Post-incident: reviewing the incident and the response
  • Practice: naming the phase from the scenario

The seven incident response phases at a glance

PhaseQuestion it answersTypical activityOften mistaken for
PreparationAre we ready to respond?Provision responder tools and access, keep asset inventories and baselines current, restore-test backupsDetection: readying tools finds no activity
DetectionIs potentially adverse activity happening?Monitoring, alerts, and user or third-party reports bring activity to responders' attentionAnalysis: a signal is not yet a determination
AnalysisWhat happened, is it an incident, and how far does it reach?Validate and characterize the activity, apply incident criteria, search other plausible targets, refine scope estimatesDetection: trusting the alert label as the conclusion
ContainmentHow do we stop it expanding?Disconnect or isolate a host, quarantine malware, halt an infected container, chosen to balance damage, evidence, and operationsRecovery: restoring data before the spread path is closed
EradicationHow do we remove it and what sustains it?Delete malware, remove persistence, disable breached accounts, mitigate exploited vulnerabilities on every affected hostContainment: a firewall block removes nothing
RecoveryHow do we return services to verified working order?Restore from clean backups or rebuild, verify integrity, confirm normal operation with system ownersContainment: restricting activity is not restoring service
Post-incidentWhat did we learn about the incident and our response?Lessons-learned meeting, after-action report, improvements to plans and controlsRecovery: a final report is not a precondition for restoring service

Decision tree

Readying people, tools, access, or data for incident response? Preparation Yes No Bringing potentially adverse activity to responders' attention? Detection Yes No Establishing what happened, whether it meets incident criteria, or its scope? Analysis Yes No Stopping the incident from expanding? Containment Yes No Removing malware, persistence, or exploited entry points? Eradication Yes No Returning affected services to verified normal operation? Recovery Yes No Post-incident review incident and response
Cheat sheet

Cheat sheet

  • Preparation establishes response capability before an incident occurs
  • Asset and dependency knowledge makes response decisions actionable
  • Established baselines help responders recognize deviations
  • Recovery readiness requires protected backups and tested restoration
  • Detection identifies activity that may require an incident response
  • Analysis determines what happened and whether incident criteria are met
  • Incident scoping must examine other plausible targets
  • Incident assessments should change as evidence resolves uncertainty
  • A validated active ransomware infection calls for containment before restoration
  • Eradication removes the compromise and the paths that sustain it
  • Containment choices balance incident risk, evidence, and operational needs
  • Delaying containment to observe an attacker requires an explicit risk decision
  • Recovery returns affected systems and services to operation
  • Recovery begins when its criteria are met rather than at an arbitrary phase boundary
  • Post-incident review examines both the incident and the response
  • Useful lessons can be applied before the incident review meeting

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
  2. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
  3. https://csrc.nist.gov/pubs/sp/800/61/r3/final
  4. https://www.cisa.gov/stopransomware/ransomware-guide