Browse tools
Incident Response Phases Cheat Sheet
NIST Incident Response framework phases and activities
Memory Trick: PICERL
Preparation Identification Containment Eradication Recovery Lessons Learned
| # | Phase | Description | Key Activities | Actions |
|---|---|---|---|---|
| 1 | Preparation | Establish IR capability before incidents occur | Create IR plan, Build team, Deploy tools, Train staff | Asset inventory, Risk assessment, Tool deployment |
| 2 | Identification | Detect and analyze potential security incidents | Monitor alerts, Analyze logs, Triage events | Determine scope, Classify severity, Document IOCs |
| 3 | Containment | Limit damage and prevent spread | Isolate systems, Block IPs, Disable accounts | Short-term: Isolate. Long-term: Harden |
| 4 | Eradication | Remove threat from environment | Remove malware, Patch vulnerabilities, Reset credentials | Find root cause, Remove all artifacts |
| 5 | Recovery | Restore systems to normal operations | Restore from backup, Rebuild systems, Validate security | Gradual restoration, Enhanced monitoring |
| 6 | Lessons Learned | Review incident and improve | Hold retrospective, Update procedures, Implement improvements | What went well? What to improve? |
Preparation is Key
Create IR plan, train team, deploy tools, and practice with tabletop exercises before an incident occurs.
Continuous Improvement
Lessons Learned is often most overlooked but critical for improving future response.