Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved. What is the last step he should list?

The final step in a standard incident response methodology is the post-incident activity, commonly referred to as a follow-up or lessons learned phase. After an incident has been contained, eradicated, and systems have been recovered, this phase is crucial for organizational improvement. It involves analyzing the incident and the response effort, identifying mistakes and successes, and implementing changes to policies, procedures, and technologies to better prevent and respond to future incidents.

A. Assign eradication is a sub-step within the "Containment, Eradication, & Recovery" phase, which occurs before the final follow-up phase.
B. Recovery is the process of restoring systems to normal operation after eradication. It is the final part of the third phase, preceding the post-incident follow-up.
C. Containment is an earlier step in the process, focused on limiting the scope and magnitude of the incident immediately after detection and analysis.

1. Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). NIST Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide. National Institute of Standards and Technology. Section 2.3, "Incident Response Life Cycle," lists the final phase as "Post-Incident Activity," which includes lessons learned and using collected data to improve security.

2. Carnegie Mellon University, Software Engineering Institute. (2016). CSIRT Services. The "Post-Incident Analysis" service is described as a critical follow-on activity to an incident, focusing on "identifying the lessons learned from the current incident in order to improve future incident response activity."

3. MITRE. (2021). ATT&CK for Industrial Control Systems (ICS) - Incident Response. The framework implicitly supports a post-incident phase by emphasizing the need to learn from attacks to improve defenses, which is the core of the follow-up step.