Which of the following is a correct flow of the stages in an incident handling and response (IH&R) process?

The correct flow for an Incident Handling and Response (IH&R) process follows a logical lifecycle designed for effective management of security incidents. The process begins with Preparation, where the team establishes tools, processes, and training. Next is Incident Recording and Assignment, followed by Incident Triage, where the event is validated and prioritized. Once confirmed, the team moves to Containment to limit the damage, then Eradication to remove the threat's root cause. Recovery restores systems to normal operation. Finally, Post-Incident Activities involve analysis, reporting, and lessons learned to improve future preparedness.

A. This flow is incorrect because Containment cannot be the first step; preparation and detection must precede it.
C. This flow is incorrect as Triage cannot happen before Preparation and Recording. The team must be prepared and the incident logged first.
D. This flow incorrectly places Preparation after Incident Recording. Preparation is the foundational phase that must happen before any incidents are handled.

1. Cichonski, P., Millar,T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology. Section 2.3, Figure 2-1, Page 11. This document outlines the standard lifecycle as: Preparation; Detection & Analysis; Containment, Eradication, & Recovery; and Post-Incident Activity. The flow in option B is a more granular, operational representation of this standard model.

2. SANS Institute. (2019). The Incident Handler's Handbook. The SANS/GIAC model also follows the PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) framework, which aligns directly with the sequence presented in option B.