In short
An incident response plan sets out how an organization handles a security incident, typically in phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.
Key takeaways
- It names roles, decision-makers and communication channels, including legal counsel and public relations.
- It includes regulatory and customer notification deadlines.
- Tabletop exercises test the plan before a real incident.
Where it's tested
ISC: Incident Response & Monitoring — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
In the NIST incident response lifecycle, which phase includes limiting the damage of an active incident and removing the attacker's foothold?