SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-ir-after-detection

In NIST's classic incident response life cycle (SP 800-61 Rev. 2), which phase follows Detection and Analysis?

Containment, Eradication and Recovery, then Post-Incident Activity.

Start playing free

  1. Post-incident activity
  2. Preparation
  3. Containment, eradication and recovery ✔

Why: The classic four phases are Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. After you confirm an incident, you contain it, remove the cause and restore services.

Huh, didn't know that: NIST SP 800-61 Rev. 3 (2025) now aligns incident response with the six CSF 2.0 Functions instead of the four phases.

The dad joke
My incident response plan has four phases and one rule: stay calm and contain it.
Like this card?
Play the game

References

Answer: Containment, eradication and recovery. The classic four phases are Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. After you confirm an incident, you contain it, remove the cause and restore services.

  1. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
    detection and analysis, containment, eradication and recovery, and post-incident activity
    Checked 2026-10-10.
  2. NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
    All six Functions have vital roles in incident response.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyUnder NIST SP 800-63B-4, what is the minimum length for a password used as the only authentication factor?Security & PrivacyWhat does NIST SP 800-63B-4 say about password rules like requiring a mix of symbols, digits and capitals?Security & PrivacyA legacy device can no longer be patched because the vendor ended support. What does NIST SP 800-40r4 suggest?

That's stuff everyone should know.