NIST Special Publication 800-61, the Computer Security Incident Handling Guide from the National Institute of Standards and Technology, describes a lifecycle that many organizations and the CySA+ exam use as the standard model for incident response (IR). Its phases are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The most recent revision of the document reorganizes guidance around the NIST Cybersecurity Framework functions, but the four-phase lifecycle is still the model you should know cold, because exam questions ask you to place actions into it.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.