Preparation
Preparation establishes roles, authority, communications, evidence sources, access, tools, procedures, exercises, and recovery options before an incident occurs.
Detection and analysis
Teams determine whether observed activity is an incident, establish scope and confidence, preserve evidence, and prioritize action according to business impact and uncertainty.
Containment, eradication, and recovery
Response limits damage, removes or neutralizes the cause, restores trustworthy operation, and validates that the environment can safely support the business.
Learning
After-action work should improve architecture, detection, procedures, training, governance, and resilience. The objective is not merely to close a ticket.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: