Which phase typically occurs before containment of an incident?

The standard incident response lifecycle, as defined by authoritative bodies like NIST, follows a logical progression of phases. An incident cannot be contained until it has first been detected and analyzed. The Identification phase involves confirming that an incident has occurred, determining its scope, and understanding its nature. Only after an incident is properly identified can the response team move to the Containment phase to limit the damage and prevent the incident from spreading further. Therefore, identification is the necessary prerequisite phase before containment.

B. Eradication, the process of removing the root cause of the incident (e.g., malware), occurs after the incident has been successfully contained.
C. Preservation of evidence is a continuous activity that occurs throughout the incident response process, not a distinct phase that precedes containment.
D. Recovery involves restoring systems to normal operation and is one of the final phases, occurring after containment and eradication are complete.

1. Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61, Revision 2). Page 6, Section 2.3, Incident Response Life Cycle. The document explicitly places "Detection & Analysis" (Identification) before "Containment, Eradication, & Recovery."

2. ISACA. (2019). Cybersecurity Audit Certificate Study Guide. Section 3.2, Incident Response Plan. The guide outlines the incident response phases in alignment with the NIST model, showing identification precedes containment.

3. Souppaya, M., & Scarfone, K. (2013). Guide to Malware Incident Prevention and Handling for Desktops and Laptops (NIST Special Publication 800-83). Page 16, Section 3.1, Incident Handling. This guide also follows the standard lifecycle where detection/identification precedes containment.