What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security incident?

The Containment, Eradication, and Recovery phase of the security incident response lifecycle is directly responsible for limiting the impact of an incident. Containment strategies are implemented to stop the incident from spreading and causing further damage. Eradication involves removing the threat actor or malware from the environment. Recovery focuses on restoring systems to normal operation. Together, these actions actively minimize the scope, severity, and overall business impact of the security incident. This phase represents the transition from analysis to active mitigation.

A. Post Incident Activity: This phase focuses on lessons learned and process improvement after the incident has been fully resolved, not on limiting its active impact.
B. Detection & Analysis: This phase is about identifying that an incident has occurred and understanding its scope, but it does not include the active mitigation steps.
C. Preparation and Identification: This phase involves proactive measures taken before an incident occurs and the initial recognition of an event, not active impact limitation.

1. ServiceNow Product Documentation: The ServiceNow Security Incident Response (SIR) application's state model is based on the NIST framework. The states "Contain

" "Eradicate

" and "Recover" are explicitly designed for mitigation activities. The "Contain" state is described as the point where actions are taken to "stop the incident from getting any worse."

Source: ServiceNow Product Documentation

"Security Incident Response states

" section on Contain

Eradicate

and Recover.

2. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide: This foundational document

which heavily influences the ServiceNow SIR lifecycle

defines this phase's purpose.

Source: NIST SP 800-61 Rev. 2

Section 3.3

"Containment

Eradication

& Recovery." The first paragraph states

"Containment is important before an incident overwhelms resources or increases damage." This directly links containment to limiting impact.