SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-incident-response-stages

Which activities belong in an incident-handling capability?

It spans preparation through detection, containment, eradication, and recovery.

Start playing free

  1. Purchasing, billing, marketing
  2. Hashing, salting, encoding
  3. Preparation through recovery ✔

Why: Incident response is a lifecycle, not a single emergency action. Preparation enables detection and analysis, followed by limiting damage, removing causes, and restoring operations.

Huh, didn't know that: Lessons from incidents should feed improvements back into preparation.

The dad joke
The response plan arrived early because preparation is its first stage.
Like this card?
Play the game

References

Answer: Preparation through recovery. Incident response is a lifecycle, not a single emergency action. Preparation enables detection and analysis, followed by limiting damage, removing causes, and restoring operations.

  1. NIST SP 800-171 Rev. 3 nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html
    includes preparation, detection and analysis, containment, eradication, and recovery
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat is the immediate goal of incident containment?Security & PrivacyWhat does incident eradication remove after containment?Security & PrivacyWhich three goals form the CIA triad?

That's stuff everyone should know.