Incident Response Steps in Order: The Sequence Security Exams Test

Updated 1 Nov 2026 · 6 min read

On this page

The Security+ order: seven steps
NIST SP 800-61 Rev. 2: the four-phase life cycle
NIST SP 800-61 Rev. 3: the CSF 2.0 model
The SANS six steps
The three models side by side
Common ordering traps
How this fits your exam
Frequently asked questions
Sources

By the end of this page you will be able to write out the seven incident response steps in the order the CompTIA Security+ SY0-701 objectives list them, say what happens in each, and map them to the NIST SP 800-61 models (the four-phase Rev. 2 and the CSF 2.0 based Rev. 3) and to the SANS six-step process. You will also know which orderings are fixed and which are looser than a numbered list suggests.

The Security+ order: seven steps

Objective 4.8 of the SY0-701 objectives, "Explain appropriate incident response activities", lists the process as Preparation, Detection, Analysis, Containment, Eradication, Recovery and Lessons learned. The objectives give only the names. The descriptions in the table below come from NIST SP 800-61 Rev. 2 and the SANS incident response glossary, which describe the same activities.

Step	What happens
1. Preparation	Establish and train the incident response team and acquire the tools and resources it needs. Selecting controls based on risk assessments is also an attempt to limit how many incidents occur.
2. Detection	Spot that something may be wrong, through monitoring tools and user reports.
3. Analysis	Decide whether an incident has actually occurred, then prioritise it. NIST says incidents should not be handled on a first-come, first-served basis.
4. Containment	Limit the spread and the damage, for example by disconnecting a system from the network. Containment buys time to plan the fix.
5. Eradication	Remove the components of the incident, such as deleting malware and disabling breached user accounts, and mitigate the vulnerabilities that were exploited.
6. Recovery	Restore systems to normal operation and confirm they are functioning normally, for example by restoring from clean backups or rebuilding from scratch.
7. Lessons learned	Review what happened, what was done and how well it worked, then improve the process.

The same objective also lists training, testing (tabletop exercise and simulation), root cause analysis, threat hunting and digital forensics (legal hold, chain of custody, acquisition, reporting, preservation and e-discovery). These are listed as separate items from the Process list, not as steps within it.

NIST SP 800-61 Rev. 2: the four-phase life cycle

NIST SP 800-61 Rev. 2, the Computer Security Incident Handling Guide, was published in August 2012. It describes four major phases: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Notice that containment, eradication and recovery are one phase in this model, while Security+ splits them into three separate steps and also splits detection from analysis.

Rev. 2 is explicit that the phases are not strictly one-way. It says that during containment and recovery, "activity often cycles back to detection and analysis", for example to check whether more hosts are infected while eradicating malware. Its post-incident activity phase includes a lessons learned meeting, which it says should be held within several days of the end of the incident.

NIST withdrew Rev. 2 on 3 April 2025. It is superseded by Rev. 3, so it is now a historical document, but it is the source of the four-phase cycle, and the CySA+ CS0-003 objectives still use its phase names.

NIST SP 800-61 Rev. 3: the CSF 2.0 model

SP 800-61 Rev. 3, published in April 2025, has a new title: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. Instead of phases, it organises incident response around the six NIST Cybersecurity Framework (CSF) 2.0 Functions: Govern, Identify, Protect, Detect, Respond and Recover.

In the Rev. 3 model, Govern, Identify and Protect are preparation activities, and NIST says they are "not part of the incident response itself". Incident response proper is Detect, Respond and Recover. Lessons learned are handled by the Improvement Category (ID.IM) within the Identify Function, and lessons from every Function feed into it. Rev. 3 also says organisations should use whichever incident response life cycle model suits them best.

Rev. 3 includes its own mapping from the old phases to the CSF 2.0 Functions, which is useful if you learned the four-phase cycle first:

Rev. 2 phase	CSF 2.0 Functions in Rev. 3
Preparation	Govern, Identify (all Categories), Protect
Detection and Analysis	Detect, Identify (Improvement Category)
Containment, Eradication and Recovery	Respond, Recover, Identify (Improvement Category)
Post-Incident Activity	Identify (Improvement Category)

The SANS six steps

SANS describes a six-step process: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned. The initials give PICERL, the name GIAC uses for this process in the GCIH objectives. SANS describes Identification as detecting potential anomalies and analysing alerts, logs and other data to determine whether a security incident occurred and classify its severity. In other words, SANS Identification covers the ground of the Security+ Detection and Analysis steps. The other five SANS names match the Security+ names.

SANS also teaches a second model, the Dynamic Approach to Incident Response (DAIR). SANS describes it as built around explicit verification, triage and iterative scoping, and uses it to verify, scope, contain, assess and remediate threats. SANS presents it as an answer to linear models, noting that attackers can return after containment.

The three models side by side

Security+ SY0-701	NIST SP 800-61 Rev. 2	SANS six steps
Preparation	Preparation	Preparation
Detection, Analysis	Detection and Analysis	Identification
Containment, Eradication, Recovery	Containment, Eradication and Recovery	Containment, Eradication, Recovery
Lessons learned	Post-Incident Activity	Lessons Learned

Rev. 3 is not in this table because it does not use a phase sequence. Use its own mapping table in the section above.

Common ordering traps

Eradicating before containing. NIST Rev. 2 places eradication after containment: "After an incident has been contained, eradication may be necessary". If a scenario describes a spreading infection, stopping the spread comes first. Rev. 2 also notes that for some incidents eradication is not needed or is performed during recovery.

Treating the order as a rigid script. The Rev. 2 incident handling checklist says it "does not dictate the exact sequence of steps that should always be followed". In that checklist, evidence acquisition appears before the containment step, and finding more affected hosts sends you back to the detection and analysis steps.

Confusing Identification with Detection. People often mix these up because SANS uses one word where Security+ uses two. If you are asked for the Security+ order, write Detection then Analysis. Identification is the SANS name for that stage.

Calling Rev. 2 current. It was withdrawn in April 2025. If you need the current NIST publication, cite Rev. 3 and its CSF 2.0 Functions.

How this fits your exam

CompTIA Security+ SY0-701: objective 4.8 lists the process as Preparation, Detection, Analysis, Containment, Eradication, Recovery and Lessons learned, alongside training, testing, root cause analysis, threat hunting and digital forensics. CompTIA lists the SY0-701 English retirement date as 11 June 2027 and expects Security+ V8 to launch on or around 17 November 2026. The Security+ SY0-701 study guide covers the rest of the exam.

CompTIA CySA+ CS0-003: domain 3.0, Incident Response and Management, is 20% of the exam. Objective 3.2 covers detection and analysis (IoCs, evidence acquisition, chain of custody, legal hold) and containment, eradication and recovery. Objective 3.3 covers the preparation and post-incident activity phases, including root cause analysis and lessons learned. CompTIA has launched CySA+ V4 (CS0-004) and says CS0-003 retires in English on 22 December 2026, so check which exam you are booking. See the CySA+ CS0-003 study guide.

GIAC GCIH: the GIAC objective "Incident Response and Cyber Investigation" says the candidate will demonstrate an understanding of the PICERL and DAIR incident handling processes. The GCIH study guide has the exam details.

Frequently asked questions

Does containment always come before eradication?

In all three sequenced models (Security+, NIST Rev. 2 and SANS), containment is listed before eradication, and NIST Rev. 2 describes eradication as happening after an incident has been contained. Rev. 2 also says that for some incidents eradication is either not necessary or is performed during recovery.

Is NIST SP 800-61 Rev. 2 still valid?

No. NIST withdrew Rev. 2 on 3 April 2025 and it is superseded in its entirety by Rev. 3. Rev. 2 remains available for historical purposes, and the CySA+ CS0-003 objectives still use its phase names: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.

Where does lessons learned fit in NIST Rev. 3?

Rev. 3 places it in the Improvement Category (ID.IM) of the Identify Function. Lessons learned from all activities in all Functions feed into Improvement and are used to inform every Function, rather than waiting for a final phase.

Sources

Put the order into practice with the Security+ SY0-701 practice questions, or read the GCIH exam guide next.