Which incident management lifecycle stage occurs after containment and eradication?

Which incident management lifecycle stage occurs after containment and eradication?

• A. Post-incident review
• B. Recovery
• C. Preparation
• D. Detection

Answer: (B)

Recovery is the stage that follows containment and eradication. Its main goal is to restore operations to normal as quickly and safely as possible. This involves restoring affected services, validating system integrity, applying patches or configurations, and continuously monitoring for any signs of residual compromise. It also includes ensuring users can access systems again, verifying performance meets requirements, and coordinating with stakeholders to communicate status. After systems are stabilized, teams often move into reviewing the incident to capture lessons learned and improve defenses for the future.

Recovery is the stage that follows containment and eradication. Its main goal is to restore operations to normal as quickly and safely as possible. This involves restoring affected services, validating system integrity, applying patches or configurations, and continuously monitoring for any signs of residual compromise. It also includes ensuring users can access systems again, verifying performance meets requirements, and coordinating with stakeholders to communicate status. After systems are stabilized, teams often move into reviewing the incident to capture lessons learned and improve defenses for the future.