Security Operations and Incident Response · Topic 3 of 4
Incident Response
The incident response plan and lifecycle, data handling during incidents, first steps, AI-related incidents, and testing through tabletop exercises and drills.
- 3 min
- Includes a diagram
- Lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.
- The IRP sets roles, communications, escalation and data handling.
- First assess and confirm; then contain.
What it is
An incident is an event that actually or potentially harms the confidentiality, integrity or availability of information or systems. Incident response (IR) is the organized way an organization handles incidents to limit damage, recover and learn. It is guided by an incident response plan (IRP) that is written and tested in advance.
How it works
The incident response lifecycle
| Phase | What happens |
|---|---|
| Preparation | Write the plan, form the team, set up tools, train and exercise |
| Detection and analysis | Confirm an incident happened and understand its scope and cause |
| Containment | Stop the damage from spreading, for example isolating a system or disabling an account |
| Eradication | Remove the cause, such as malware or a tampered data source |
| Recovery | Return systems to normal operation safely and monitor closely |
| Lessons learned | Review what happened and improve controls and the plan |
The incident response plan
The plan defines roles (incident lead, technical team, communications, legal, management), contact lists, severity levels, how to escalate and how to communicate with staff, customers and regulators. It also sets data handling during an incident: how evidence and affected data are protected, who may see them and what must be reported.
When a possible incident is reported, the first step is to open an incident and assess what happened. Drastic actions or public announcements come after the facts are known.
First steps in common situations
| Situation | First step |
|---|---|
| Employee pasted customer records into a public AI chatbot | Open an incident and assess the exposure |
| Malware found on a laptop | Isolate it from the network |
| Suspicious login on an account | Confirm with the user and disable or reset the account if needed |
| Customer-support chatbot exposing other customers' details | Confirm in the logs, then take it offline and cut its data connection |
Evidence
Preserve evidence: do not wipe or rebuild a system before the team has captured what it needs. Record who handled evidence and when (chain of custody), in case legal action follows.
IR exercises
| Exercise | What it is |
|---|---|
| Tabletop exercise | Team members talk through a scenario around a table to check roles and decisions |
| Walkthrough | Step-by-step review of the plan |
| Simulation | A realistic practice incident, often using test systems |
| Full test | Live execution of response steps |
Exercises reveal gaps in the plan before a real incident does. Update the plan after every exercise and every real incident.
How the exam asks about this
- "Which phase removes the root cause?" Eradication.
- "What is a tabletop exercise?" A discussion-based walk through of a scenario.
- "Customer records were pasted into a public chatbot. What first?" Open an incident and assess the exposure.
What to remember for the exam
- Lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.
- The IRP sets roles, communications, escalation and data handling.
- First assess and confirm; then contain.
- Preserve evidence and record its handling.
- Exercise the plan with tabletops and simulations, then update it.
Notifying every customer before the scope is known can be premature and inaccurate. Notifications follow assessment and legal advice.
Common mistakes
Mixing up containment and eradication.
Wiping systems before evidence is preserved.
Never testing the plan.
Check yourself
Which IR phase stops damage from spreading?
Containment.
What is the purpose of the lessons learned phase?
To review the incident and improve controls and the plan.
What kind of exercise talks through a scenario without touching systems?
A tabletop exercise.
Topic 3 of 4 in Security Operations and Incident Response
Test yourself on Security Operations and Incident Response
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.