What is the correct order of phases in the NIST incident response lifecycle (SP 800-61)?
A CISSP practice question covering Domain 7: Security Operations. Try answering before reading the explanation below.
Show options & answer
Why "Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity" is the right answer
NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. SANS uses six phases (PICERL). Either may appear; the question asks specifically for NIST.
Study videos for this topic
Want to go deeper on Domain 7? Watch the full breakdown — every video is free, no account, no upsell.
Take the full CISSP practice test
120 questions, instant explanations, study-video links on every miss. No account.