Scenario
After a ransomware tabletop exercise exposed gaps in the company's response, the security manager is updating the incident-response runbook. Arrange the NIST SP 800-61 lifecycle phases from the work performed before an incident through post-incident improvement.