NIST Incident Response Life Cycle (NIST 800-61)

NIST Incident Response Life Cycle (NIST 800-61) for Cisco CyOps Associate

Step 1 : Preparation

The members of the CSIRT are trained in how to respond to an incident. CSIRT members should continually develop knowledge of emerging threats.

Step 2 : Detection and Analysis

Through continuous monitoring, the CSIRT quickly identifies, analyzes, and validates an incident.

Step 3 : Containment, Eradication, and Recovery

The CSIRT implements procedures to contain the threat, eradicate the impact on organizational assets, and use backups to restore data and software. This phase may cycle back to detection and analysis to gather more information, or to expand the scope of the investigation.

Step 4 : Post-Incident Activities

The CSIRT then documents how the incident was handled, recommends changes for future response, and specifies how to avoid a reoccurrence.