Lesson 2 of 5
Not started
Incident Response, BC & DR Concepts
Incident response phases, business continuity planning, and disaster recovery concepts and metrics.
An incident is an event that actually or potentially harms the CIA of information. Incident response (IR) follows defined phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity (lessons learned).
An organization defines an incident response plan and team roles in advance. The goal is to limit damage, restore service quickly, and improve defenses afterward. Clear communication and documentation throughout are essential.
Which is the correct high-level order of incident response?
What is the purpose of the post-incident (lessons learned) phase?