Contain, then recover, then learn
- Rule
- Contain, then recover, then learn
- Exam
- CISM
- What it means
Incident questions follow a sequence: preparation, detection, containment, eradication, recovery, lessons learned. Preserve evidence along the way.
- The trap answer looks like
Restore from backup immediately, or hunt the attacker before stopping the spread.
- The winning answer looks like
Contain the damage, preserve evidence, eradicate the cause, recover, then review.
- Worked example
Ransomware is spreading across the network. What FIRST?
- ✅ Isolate affected systems and segments
Restoring onto a network that is still infected only feeds the fire.