Incident Response Fundamentals and Frameworks
The fundamentals domain tests whether you can define incident response precisely, place any activity inside a recognised lifecycle, and explain why the chosen framework shapes every later decision. Expect questions that contrast frameworks, ask where a task belongs, or test vocabulary such as event versus incident.
Core vocabulary
- An event is any observable occurrence in a system or network. An incident is an event, or group of events, that actually or imminently jeopardises confidentiality, integrity, or availability, or violates policy.
- Incident handling covers the whole lifecycle including preparation; incident response is often used for the reactive portion. Watch which term a question uses.
- CSIRT / IR team roles: incident commander, analyst or handler, communications lead, legal counsel, forensics lead. One person may hold several roles in a small team.
Frameworks you must be able to compare
- NIST SP 800-61 Rev 2 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. It is the model most exam questions assume.
- NIST SP 800-61 Rev 3 restructures guidance around the CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) and emphasises integration with enterprise risk management rather than a standalone lifecycle.
- SANS six steps: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned - commonly abbreviated PICERL. It splits identification from containment more finely than NIST.
- ISO/IEC 27035 describes plan-and-prepare, detection-and-reporting, assessment-and-decision, response, and lessons-learned, with a strong documentation and improvement emphasis.
Worked example
An EDR alert shows procdump.exe reading LSASS memory on a finance workstation, followed by an outbound connection to an unfamiliar IP. Step one is classification: this is not a lone event, because credential dumping plus egress indicates active compromise, so it is an incident. Step two is placement: the alert is Detection and Analysis; isolating the host is Containment; credential resets and malware removal are Eradication; restoring the workstation to production is Recovery. Naming the phase matters because authorisation, evidence handling, and notification duties differ by phase.
Traps
- Treating the lifecycle as strictly linear. Analysis continues during containment; new findings send you back a phase.
- Calling every alert an incident, or dismissing a policy violation because nothing broke.
- Answering with a framework's phase name when the question asks for a role or a decision authority.