Security Operations · Topic 5 of 9
Incident Management
The CISSP incident management process: detection, response, mitigation, reporting, recovery, remediation and lessons learned, with roles and priorities.
- 3 min
- Steps: detection, response, mitigation, reporting, recovery, remediation, lessons learned.
- Safety first, then containment, with evidence preserved.
- Severity follows business impact.
What it is
Incident management is the organized response to events that threaten security. A planned, practiced process limits damage, preserves evidence, restores services and improves defenses. The CISSP outline lists the steps as detection, response, mitigation, reporting, recovery, remediation and lessons learned.
How it works
The steps
| Step | Activities |
|---|---|
| Detection | Alerts, user reports and monitoring identify a possible incident; triage confirms it |
| Response | Activate the incident response team and plan; assign roles |
| Mitigation (containment) | Limit spread and damage: isolate systems, disable accounts, block traffic |
| Reporting | Inform management, legal, and where required regulators, customers and law enforcement |
| Recovery | Restore systems and data to normal operation, verified clean |
| Remediation | Remove the root cause: eradicate malware and persistence, fix vulnerabilities |
| Lessons learned | Review what happened, document root causes and control gaps, improve the plan |
Priorities during response
- People's safety comes first.
- Contain to stop the spread; containment comes before convenience (for example finishing a batch job).
- Preserve evidence: isolate rather than power off where memory matters; snapshot before rebuilding.
- Restore business using alternatives (standby systems, other processing paths).
- Eradicate before returning hosts to production, or they reinfect the network.
When a failover or standby exists, use it to restore service while the compromised system is isolated and imaged. You can have both business continuity and evidence.
Severity and escalation
Severity is driven by business impact on systems and data, not by the number of alerts or who reported it. Escalation paths and decision authority are defined in the plan.
Communication
- Use out-of-band channels if attackers may control email or chat.
- Only the designated spokesperson speaks to the media, using statements cleared by legal.
- Notification decisions involve legal counsel and executives.
Insider incidents
When an insider is the suspected actor, act on risk now: remove privileged access, disable rogue accounts and preserve logs, coordinating with HR and legal. Do not alert the person before evidence is safe.
Exercises
Tabletop exercises expose gaps in roles and decisions. Technical tests verify tools and procedures. Run both, and update the plan after each.
How the exam asks about this
- "Ransomware is spreading; the payroll owner wants the server up for two hours." Isolate the segment, keep hosts running for evidence, arrange another payroll path.
- "Malware hosts are isolated. What before returning them to production?" Eradicate the malware and its persistence.
- "A journalist calls four hours into an unscoped incident." The designated spokesperson with a legal-cleared holding statement.
What to remember for the exam
- Steps: detection, response, mitigation, reporting, recovery, remediation, lessons learned.
- Safety first, then containment, with evidence preserved.
- Severity follows business impact.
- Out-of-band communication when internal channels may be compromised.
- Lessons learned feed improvements to controls and the plan.
Rebuilding or wiping a compromised system before imaging it destroys evidence and can hide the root cause.
Common mistakes
Powering systems off when isolation would preserve memory.
Letting business convenience delay containment.
Skipping lessons learned once service is restored.
Check yourself
In which step are root causes and control gaps formally documented?
Lessons learned.
What should drive an incident's severity rating?
The business impact on the affected systems and data.
Why coordinate out of band in a suspected domain compromise?
The attacker may control the normal email and chat systems.
Topic 5 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.