Which sequence correctly outlines the general steps of incident response?

Which sequence correctly outlines the general steps of incident response?

• A. Identify, contain, eradicate, recover, and review.
• B. Identify, contain, recover, eradicate, and review.
• C. Identify, contain, eradicate, recover, and review.
• D. Identify, contain, eradicate, review, and recover.

Answer: (B)

After identifying what happened and containing the incident to stop further damage, the priority becomes getting systems back up and running. This allows the business to resume essential operations even while the cleanup continues. Recovery focuses on restoring services and normal functions so that downtime is minimized. Once recovery is underway or complete, the next step is to fully eradicate the threat from the environment, removing the root cause and any backdoors or artifacts. Finally, a review captures lessons learned and helps improve defenses and response for the future. This order aligns rapid restoration with completing the cleanup, then documenting what was learned.

After identifying what happened and containing the incident to stop further damage, the priority becomes getting systems back up and running. This allows the business to resume essential operations even while the cleanup continues. Recovery focuses on restoring services and normal functions so that downtime is minimized. Once recovery is underway or complete, the next step is to fully eradicate the threat from the environment, removing the root cause and any backdoors or artifacts. Finally, a review captures lessons learned and helps improve defenses and response for the future. This order aligns rapid restoration with completing the cleanup, then documenting what was learned.