Incident Management
Domain 5 - Incident Management
This domain tests how you prepare for, detect, contain, eradicate, recover from, and learn from security incidents. Expect questions on lifecycle, severity, roles, communications, and evidence.
Core rules and concepts
- Use a lifecycle such as NIST SP 800-61: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Preparation includes playbooks, contacts, tooling, and authority to act.
- Classify severity by business impact and scope, not by attacker sophistication. Define decision rights for isolation, shutdown, ransom negotiation, and regulatory notification.
- Preserve evidence with chain of custody; involve legal counsel for privilege and notification obligations. Communicate with one voice to employees, customers, regulators, and media.
- Run exercises and tabletops; capture lessons learned with owners and deadlines. Track metrics such as time to detect, time to contain, and repeat root causes.
Worked example
Ransomware encrypts file shares at a subsidiary. The incident commander declares severity high because order fulfillment is affected. The team isolates affected network segments, preserves domain controller logs, and validates backups before restoration. Legal assesses breach notification; communications releases a holding statement. The team resists immediate reimaging of all hosts to preserve evidence and avoid reinfection. After recovery, the post-incident review finds an unpatched VPN and adds MFA and segmentation. Reasoning: containment and evidence precede eradication; recovery depends on trusted backups.
Traps that cost marks
- Jumping to eradication before containment and evidence preservation.
- Treating every alert as an incident without severity criteria.
- Letting IT operations and security run separate, conflicting communications.
- Skipping post-incident actions or assigning no owners.