Incident Handling · Topic 4 of 4
Incident Response Policy, Plan and Lifecycle
Learn the elements of an incident response policy, plan and procedures, and the NIST SP 800-61 lifecycle stages from preparation to post incident activity.
- 5 min
- Includes a diagram
- The policy sets rules and authority, the plan sets the approach, and procedures give the steps.
- NIST SP 800-61 has four stages in its lifecycle.
- The stages are preparation, detection and analysis, containment, eradication and recovery, and post incident activity.
What it is
Incident response is the organised way an organisation prepares for, detects, handles and learns from security incidents.
Without a plan, people panic, make mistakes and lose evidence. With one, the right people know what to do, in what order, and who has the authority to decide.
This page covers the three levels of documents, and then the four stages of the response lifecycle described in NIST Special Publication 800-61.
How it works
Documents set the rules in advance, and the lifecycle guides the work during and after an incident.
Policy, plan and procedure
These three documents work together at different levels of detail.
| Document | Purpose | Typical content |
|---|---|---|
| Policy | Management's rules and authority | Statement of commitment, purpose, scope, what counts as an incident, roles and responsibilities, how severity is ranked, reporting rules |
| Plan | The overall approach to response | Mission and goals, how the team is organised, how to contact outside parties, how success is measured, approval by senior management |
| Procedure | Detailed step by step instructions | Checklists and standard operating procedures for tasks such as isolating a host |
The policy says what must happen and who has authority. The plan says how the organisation will carry it out. The procedures give the exact steps so that staff act consistently, even under stress.
The policy should also state who is allowed to declare an incident, and when to involve legal staff, management, and outside bodies such as law enforcement.
The incident response lifecycle
NIST SP 800-61 describes four stages in the structure that the outline section numbers point to. Other editions of the document arrange the material differently, so learn these four stages for this exam. They are a cycle, because the last stage feeds back into the first.
Preparation
Preparation is everything done before an incident. It includes writing the policy, plan and procedures, forming the incident response team, and training them. It also includes setting up tools, such as logging and monitoring, contact lists, and a secure place to store evidence.
Preparation also means preventing incidents by securing systems, patching, and training users. Good preparation shortens the response later.
Detection and analysis
This stage finds incidents and decides how serious they are. Sources of signs include alerts from security tools, logs, user reports and outside notices.
Analysts:
- confirm whether the event is a real incident or a false positive
- work out what is affected and what the attacker did
- rank the incident by severity, so the response matches the size of the problem
- document everything with times
Containment, eradication and recovery
This stage deals with the incident itself, in three steps.
| Step | Goal | Examples |
|---|---|---|
| Containment | Stop the damage from spreading | Isolate a host, block an address, disable an account |
| Eradication | Remove the cause | Delete malware, close the weakness, reset credentials |
| Recovery | Return to normal operation | Restore systems from clean backups, monitor closely afterwards |
Containment comes first and is often done quickly to limit harm. Evidence should be preserved before systems are changed or wiped. Recovery includes watching for signs that the attacker returns.
Post incident activity
After the incident, the team holds a lessons learned review. It asks what happened, how well the team responded, what slowed them, and what to change. The results update the policy, plan, procedures and controls, and the evidence and reports are stored.
This is the stage that is easiest to skip and one of the most valuable, because it stops the same problem happening again.
Putting it together
The stages are not always neat, and new findings during recovery may send the team back to analysis. What matters is that the team keeps records, communicates clearly, and follows the plan.
What to remember for the exam
Seven facts cover most questions on this topic.
- The policy sets rules and authority, the plan sets the approach, and procedures give the steps.
- NIST SP 800-61 has four stages in its lifecycle.
- The stages are preparation, detection and analysis, containment, eradication and recovery, and post incident activity.
- Preparation happens before any incident.
- Containment stops the spread, eradication removes the cause, and recovery restores service.
- Preserve evidence before wiping or rebuilding systems.
- The lessons learned review feeds back into preparation.
Put the stages in order. Prepare, detect and analyse, contain then eradicate then recover, and finally learn.
Common mistakes
These four errors are common.
Starting eradication before containment. Removing malware from one system while it spreads to others wastes effort.
Skipping the lessons learned review. The same weakness can then lead to the next incident.
Not preparing in advance. A plan written during a crisis is slow and incomplete.
Confusing policy and procedure. The policy is a high level rule, and the procedure is a detailed set of steps.
Wiping a system before collecting evidence can destroy the information needed to understand and prove what happened.
Check yourself
Work through these three questions.
What are the four stages of the incident response lifecycle in NIST SP 800-61?
Preparation, detection and analysis, containment, eradication and recovery, and post incident activity.
What is the difference between containment and eradication?
Containment stops the damage from spreading. Eradication removes the cause, such as the malware or the weakness.
What happens in the lessons learned review?
The team reviews what happened and how well it responded, then updates the policy, plan, procedures and controls.
Topic 4 of 4 in Incident Handling
Test yourself on Incident Handling
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.