Information Security Incident Management and Operations
This domain tests what you do in the first ten minutes of an incident and how you keep the business running. The examiner looks for the manager's sequence: follow the plan, activate the team, contain without destroying evidence, communicate, then learn.
Core rules
- Lifecycle. Preparation → detection and analysis → containment, eradication and recovery → post-incident review. Preparation covers the plan, roles, contact lists, playbooks, tooling and exercises. Detection depends on logging, monitoring and a culture where staff report anomalies.
- Do not destroy evidence. Powering off a compromised host wipes volatile memory. Isolate it from the network, preserve logs, and maintain chain of custody with documented handling of every item, hash values and timestamps. Forensic imaging precedes remediation where an investigation or legal action is possible.
- Escalation and communication. Severity criteria determine escalation. A pre-approved communication plan covers internal, customer, media and regulator messaging; legal counsel and communications own external statements, not the security analyst.
- Continuity and recovery. BIA derives the MTD; RTO is the target restore time and RPO the acceptable data loss window. DR strategies trade cost against speed - hot site, warm site, cold site, or cloud failover. Backup follows the 3-2-1 pattern with at least one offline or immutable copy, because ransomware targets connected backups.
- Testing. Tabletop, simulation, parallel and full-interruption tests. Full interruption is the most realistic and the most disruptive; most organisations validate with tabletop and simulation first.
- Metrics. MTTD and MTTR expose whether detection and response are improving.
Worked example
Ransomware is detected encrypting files on a file server. Wrong first moves: shutting the server down, or paying. Correct sequence: activate the incident response plan and team; isolate the host at the network layer to stop lateral spread while preserving memory; determine scope across other hosts and backups; check whether offline/immutable backups are intact; involve legal, HR and communications per the plan; restore from a validated clean backup; then run a post-incident review covering root cause, detection gap and control improvements.
Traps that cost marks
- "Power off the server" or "delete the malware" as the first action.
- Notifying regulators or the press before internal escalation and legal review.
- Confusing RTO (downtime tolerance) with RPO (data loss tolerance).
- Treating a post-incident review as optional, or omitting the root-cause follow-up.