[Introduction to Incident Handling and Response] James has been appointed as an incident handling and response (IH&R) team lead and he was assigned to build an IH&R plan along with his own team in the company. Identify the IH&R process step James is currently working on.

The scenario describes James building an incident handling and response (IH&R) team and creating the associated plan. These are foundational, proactive activities performed to establish an organization's capability to respond to security incidents. According to standard incident response lifecycle models, such as the one detailed in NIST SP 800-61, these tasks are the core components of the Preparation phase. This phase occurs before any incident takes place and ensures that the necessary policies, procedures, personnel, and tools are in place to handle future events effectively. James is establishing the framework for response, not reacting to an active incident.

A. Eradication: This is a reactive phase that involves removing the root cause of an incident after it has been identified and contained.
B. Recovery: This phase focuses on restoring affected systems and services to normal operation after a threat has been eradicated.
D. Notification: This is the process of informing relevant stakeholders (e.g., management, legal, customers) about an incident, which occurs during or after an incident, not in the initial planning stage.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 2.3.1

"Preparation" (Page 8): This section explicitly states that the preparation phase includes "establishing and training an incident response team" and creating "policies and procedures for incident handling." James's activities directly align with this definition.

2. Carnegie Mellon University

Software Engineering Institute. (2004). State of the Practice of Incident Response. CMU/SEI-2004-TR-001.

Section 3.1

"Preparing to Handle Incidents" (Page 11): This section describes the preparation phase as involving the creation of policies

plans

procedures

and the formation of the incident response team

which is precisely what James is tasked with.

3. University of Washington

UW-IT. (n.d.). Incident Response. Courseware/Documentation.

"Incident Response Lifecycle" section: The documentation

based on the SANS/NIST model

defines the "Preparation" phase as the stage where "policies and procedures are developed" and "the team is created and trained." This directly supports the conclusion that James is in the Preparation phase.