After an incident has been eradicated, which of the following should be done NEXT?

The correct answer is D. Perform a root cause analysis. After eradication, the immediate next step is root cause analysis (D) - you need to understand how the incident occurred before you can effectively recover, harden systems, or prevent recurrence. Without knowing the root cause, recovery efforts may leave underlying…

Submitted by noor.lb· Apr 18, 2026Information Security Incident Management

Question

Options

ACategorize the incident
BReport to senior management
CUpdate the risk register
DPerform a root cause analysis

How the community answered

(58 responses)

A
9% (5)
B
5% (3)
C
2% (1)
D
84% (49)

Explanation

After eradication, the immediate next step is root cause analysis (D) - you need to understand how the incident occurred before you can effectively recover, harden systems, or prevent recurrence. Without knowing the root cause, recovery efforts may leave underlying vulnerabilities in place.

Why the distractors are wrong:

(A) Categorize the incident - categorization happens early in the process (during identification/triage), not after eradication.
(B) Report to senior management - reporting typically occurs during or after containment, and again in the post-incident review; it's not the immediate next action post-eradication.
(C) Update the risk register - this is a post-incident activity that comes later, informed by the root cause analysis itself; you can't accurately update risk without first understanding what went wrong.

Memory tip: Think of the incident lifecycle as Prepare → Identify → Contain → Eradicate → Analyze → Recover → Review. Root cause analysis bridges eradication and recovery - you must understand the "why" before you can safely restore operations and close the loop.

Topics

#Incident Response Lifecycle#Post-Incident Activities#Root Cause Analysis#Incident Eradication

Community Discussion

No community discussion yet for this question.

Full CISM Practice