Phases of an incident response playbook

Question 1

1. Preparation

Answer 1

Before incidents occur, mitigate potential impacts on the organization by documenting, establishing staffing plans, and educating users.

Question 2

2. Detection and analysis

Answer 2

Detect and analyze events by implementing defined processes and appropriate technology.

Question 3

3. Containment

Answer 3

Prevent further damage and reduce immediate impact of incidents.

Question 4

4. Eradication and recovery

Answer 4

Completely remove artifacts of the incident so that an organization can return to normal operations.

Question 5

5. Post-incident activity

Answer 5

Document the incident, inform organizational leadership, and apply lessons learned.

Question 6

6. Coordination

Answer 6

Report incidents and share information throughout the response process, based on established standards.