When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?

According to the standard incident response lifecycle defined by NIST, the first step after an incident has been detected and analyzed is Containment. The primary goal of containment is to limit the immediate damage and prevent the incident from spreading to other systems or networks. This step is crucial for stabilizing the situation and giving the response team time to develop a tailored strategy for eradication and recovery. Acting quickly to contain the incident minimizes the overall impact on the organization.

A. Escalation is a sub-process within the lifecycle, occurring when an incident's severity requires notifying management or bringing in more resources.
B. Recovery is a later phase focused on restoring systems to normal operation after the threat has been fully eradicated.
C. Eradication involves removing the root cause of the incident (e.g., malware) and occurs only after the incident has been successfully contained.

1. Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). NIST Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide. National Institute of Standards and Technology. Section 3.2.3, "Containment, Eradication, & Recovery," explicitly states, "Containment is the first step in this phase."

2. SANS Institute. (2021). Incident Handler's Handbook. The SANS incident handling process (PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) clearly places Containment as the first active response step after Identification.

3. Kent, K., & Souppaya, M. (2006). NIST Special Publication 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling for Desktops and Laptops. Section 4.3, "Containment," describes this as the initial step to isolate infected hosts to prevent malware from spreading.