Cybersecurity incident management and continuous improvement
What the exam tests
Incident-management lifecycle, roles, escalation, evidence, communication, metrics and continual improvement after incidents and exercises.
Lifecycle
- Prepare: policy, plans, playbooks, contact lists, tools, training and exercises.
- Detect and analyze: monitor, triage, assign severity and preserve evidence.
- Contain, eradicate and recover: isolate affected systems, remove the cause and restore services safely.
- Communicate: inform management, legal, regulators, customers and partners as required; respect reporting timelines.
- Learn: establish root cause, lessons learned, corrective actions, and updates to controls and risk assessment.
Exercises test plans and contacts. Metrics such as time to detect and time to recover show improvement. Evidence handling matters if law enforcement or disciplinary action follows.
Worked example
A phishing email leads to ransomware on a file server. The team isolates the server, preserves logs and images, notifies management and legal, checks lateral movement, restores from a tested backup, resets credentials and reviews the incident. Corrective actions add MFA and network segmentation. The reasoning: contain first, preserve evidence, communicate according to plan, then improve controls and risk assessment.
Traps
Deleting or overwriting logs; treating every alert as a confirmed incident; having no out-of-hours contact; fixing technology only; missing regulatory notification; running no exercises; failing to update risk assessment after lessons learned.