What are the stages of incident response, and what indicators show the effectiveness of an incident response plan?

• A. Preparation, Detection/Analysis, Containment, Eradication, Recovery, Lessons Learned; indicators include mean time to detect/contain/respond, remediation time, incident closure rate, and post-incident reviews.
• B. Detection/Analysis stage only
• C. Recovery stage only
• D. Containment stage only

Answer: (A)

Incident response is a structured lifecycle that includes six stages: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation sets up the plans, roles, runbooks, and tools so the team can act quickly. Detection and analysis identify incidents, determine scope, and decide on actions. Containment stops further spread, eradication removes the root cause, and recovery restores operations to normal while verifying systems are clean. Lessons learned feeds back into improvements for people, processes, and technology.

The indicators of effectiveness measure how well the plan performs in practice. Key metrics include mean time to detect, mean time to contain, and mean time to respond, which show how quickly the team recognizes and limits incidents. Remediation time reflects how long it takes to fix underlying issues, while the incident closure rate indicates how thoroughly incidents are concluded. Post-incident reviews or lessons learned reveal the quality of improvements and the organization’s ability to prevent recurrence.

This end-to-end view, with concrete performance metrics, best demonstrates how well an incident response plan works and where to target enhancements. Limiting focus to a single stage misses the comprehensive cycle and the needed feedback loop for continuous improvement.