The helpdesk reports increased calls from clients reporting spikes in malware infections on their systems. Which of the following phases of incident response is MOST appropriate as a FIRST response?

Recovery restores systems to normal operation and occurs only after containment and eradication have been completed, not as an initial response step.

Follow-up, also called lessons learned, is the final phase conducted after the incident is fully resolved to improve future response capabilities.

Validation is not a standard named phase in the NIST SP 800-61 incident response lifecycle.

The identification phase involves detecting, analyzing, and validating that a security incident has actually occurred and determining its initial scope, which is the prerequisite before any other response action can be taken. In this scenario, the spike in malware infections must first be confirmed as a coordinated incident, affected systems catalogued, and the threat characterized before responders can act. Proceeding to containment or eradication without proper identification risks missing affected systems or mischaracterizing the threat type.

Eradication removes the malware or attacker presence from affected systems but can only be executed effectively after the incident has been identified and its scope determined.

Containment limits the spread of an incident but requires prior identification to know which systems to isolate and what vectors to block.