As part of incident response activities, the BEST time to begin the recovery process is after:

The correct answer is D. the eradication phase has been completed. Standard incident response frameworks (NIST SP 800-61, SANS PICERL) sequence phases in a specific order: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. Recovery must follow eradication because restoring systems before the threat has been…

Submitted by kevin_r· Apr 18, 2026Information Security Incident Management

Question

Options

Athe incident response team has been established
Bthe root cause has been determined
Cthe incident manager has declared the incident
Dthe eradication phase has been completed

How the community answered

(52 responses)

A
2% (1)
B
6% (3)
C
2% (1)
D
90% (47)

Explanation

Standard incident response frameworks (NIST SP 800-61, SANS PICERL) sequence phases in a specific order: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. Recovery must follow eradication because restoring systems before the threat has been fully removed risks re-infection or re-compromise of the restored environment. Establishing the IR team (A) occurs during preparation, declaring the incident (C) occurs during identification, and determining root cause (B) is part of eradication - all precede recovery. Beginning recovery before eradication is complete is a common and costly mistake.

Topics

#Incident Response Lifecycle#Recovery Phase#Eradication Phase#Incident Management Phases

Community Discussion

No community discussion yet for this question.

Full CISM Practice