Incident response lifecycle: order of steps
The incident response lifecycle is the ordered set of phases a team follows from getting ready for an incident to learning from it. In the classic NIST model (SP 800-61 Rev. 2) the phases are preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. The decision rule for the exam: find the phase the scenario is in, then choose the action that belongs to the next one. Contain before you eradicate, eradicate before you recover, and never skip the review at the end.
The same incident, walked through phase by phase
A small worked example makes the order stick. A file server at a company starts renaming files with a strange extension on a Tuesday afternoon.
| Step | What happens in the example | Phase |
|---|---|---|
| 0 | Months earlier, the team wrote a ransomware playbook, tested backups and agreed who may isolate servers | Preparation |
| 1 | An endpoint alert fires, an analyst confirms mass file renaming and decides this is a real incident, not a false positive | Detection and analysis |
| 2 | The analyst scopes it: one server, one compromised service account, no spread yet. Severity and priority are set | Detection and analysis |
| 3 | The server is isolated from the network and the account is disabled. Evidence is preserved first where the process requires it | Containment |
| 4 | The malware is removed, the entry point is closed, passwords are reset | Eradication |
| 5 | Data is restored from a clean backup, the server returns to service under close monitoring | Recovery |
| 6 | A review meeting asks what was missed, which control failed and what changes | Post-incident activity (lessons learned) |
Two details matter in exams. First, analysis is not the same as containment: confirming and scoping come before you pull the plug, unless the scenario says the damage is spreading right now. Second, evidence handling runs through the whole process. Volatile data, logs and images should be preserved with a documented chain of custody before cleanup destroys them.
Rev. 2 versus Rev. 3, and why the wording differs between exams
NIST SP 800-61 Rev. 2 (2012) is the source of the four-phase cycle above. NIST withdrew it on 3 April 2025 and replaced it with Rev. 3, titled “Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile”. Rev. 3 no longer presents a separate four-box lifecycle. It maps incident response onto the functions of NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover) and treats preparation and improvement as part of ordinary risk management, not as bookends.
For an exam this means vendors use different splits of the same work:
| Source | Phases as usually listed |
|---|---|
| NIST SP 800-61 Rev. 2 | Preparation; detection and analysis; containment, eradication and recovery; post-incident activity |
| CompTIA SY0-801 (objective 4.7) | Preparation; identification; investigation; containment; negotiation; eradication and recovery; notification and external reporting; post-incident (lessons learned, root cause analysis) |
| NIST CSF 2.0 functions (Rev. 3) | Govern, Identify, Protect, Detect, Respond, Recover |
Do not memorise one list as the only truth. Memorise the sequence of work and learn which labels the exam in front of you uses. If the question names a framework, answer in that framework’s terms.
Exam traps and the words that decide the answer
Most incident questions ask for the first, next or best action. The constraint words that decide it:
- “First” after a confirmed compromise usually points to containment (isolate, disable the account), not to eradication or a full investigation.
- “Before” cleanup or rebuild points to evidence preservation: forensic image, memory capture, log export.
- “Prevent a recurrence” or “improve the process” points to lessons learned and root cause analysis, which come after recovery.
- “Tabletop exercise”, “playbook”, “contact list”, “training” are preparation, even if the scenario sounds like an incident.
- “Determine whether it is a real incident” is analysis. Triage and classification precede escalation.
- “Restore from backup” is recovery. It is wrong if the attacker’s access has not been removed yet.
The common confusion is eradication versus recovery. Eradication removes the cause (malware, rogue accounts, the vulnerability that let them in); recovery returns systems to normal operation. Restoring a system while the persistence mechanism still exists simply re-infects it.
A second confusion is containment versus eradication. Isolating a host stops the spread but leaves the malware in place. If the options include “isolate the host” and “wipe the host” and the incident was just confirmed, isolation is normally the first of the two.
Which exams test this
| Exam | How the topic appears | Where it is covered on this site |
|---|---|---|
| SY0-801 | Security Operations domain (27%), objective 4.7: incident response activities from preparation (tabletop exercises, playbooks) through identification, investigation with forensics and chain of custody, containment, eradication and recovery, notification and post-incident lessons learned; objective 4.8 covers the data sources used in an investigation | SY0-801 security operations explained |
| SC-200 | Respond to security incidents domain (35–40%, outline as of October 21, 2026): investigate and remediate alerts and incidents in Defender XDR and Microsoft Sentinel, take response actions on devices such as live response and collecting investigation packages, and manage incidents with case management. The exam tests the tooling rather than the NIST phase names | SC-200 respond to incidents explained |
| AAISM | AI Governance and Program Management domain (31%), subtopic 1E Business Continuity and Incident Response; a supporting task names AI incident handling with containment, notification, escalation, eradication and recovery | AAISM governance and programme management explained |
| AAIR | AI Risk Program Management domain (42%), subtopic 3F AI Incident Response, BIA, Business Continuity and Disaster Recovery: building AI risk scenarios into the incident management program | AAIR risk program management explained |
| AAIA | AI Operations domain (46%), subtopic 2G Incident Response Management specific to AI, seen from the auditor’s side: evaluating whether the incident management program covers AI | AAIA AI operations explained |
Two practice questions
Question 1. Endpoint monitoring confirms that a workstation is communicating with a command-and-control server and the malware is actively spreading to file shares. According to the incident response lifecycle, what should the team do first?
- A. Reimage the workstation and restore from backup
- B. Isolate the workstation from the network and block the command-and-control destination
- C. Write the lessons learned report
- D. Update the incident response playbook
Show answer
Answer: B
The incident is confirmed and spreading, so the immediate need is to stop the damage: containment, such as isolating the workstation and blocking the destination. Reimaging is eradication and recovery work that comes later, and doing it first would destroy evidence. Writing the lessons learned report is the last phase. Updating the playbook is preparation and does not stop the spread.
Question 2. A ransomware infection has been contained and the malware removed from all affected servers. The accounts that the attacker used have been disabled. Which activity belongs to the next phase?
- A. Isolate further hosts from the network
- B. Search the network for additional indicators of compromise
- C. Run a tabletop exercise for the executive team
- D. Restore the servers from clean backups and monitor them closely
Show answer
Answer: D
Containment and eradication are finished, so the next phase is recovery: restoring systems from clean backups and returning them to service with enhanced monitoring. Isolating more hosts repeats containment. Searching for more indicators of compromise is analysis, which continues but is not the next phase. Running a tabletop exercise is preparation for future incidents.
Go deeper
- NIST SP 800-61 Rev. 3 (CSRC publication page)
- NIST SP 800-61 Rev. 2 (withdrawn 3 April 2025)
- Incidents and alerts in the Microsoft Defender portal (Microsoft Learn)
- Related guides: Microsoft Sentinel explained, SIEM vs SOAR vs XDR, NIST and ISO security frameworks, and the attack types that start most incidents.