What is the first step in handling an incident?

• A. Preparation
• B. Detection and Analysis
• C. Containment, Eradication, and Recovery
• D. Post-Incident Activity

Answer: (A)

Preparation establishes the foundation for incident response. It sets up the policies, roles, and responsibilities, and puts in place the tools, training, and communication channels you’ll rely on when something goes wrong. With a solid preparation phase, you have defined playbooks, contact lists, and escalation paths, as well as rehearsed procedures so you can detect and analyze incidents accurately and quickly. It also includes building the capability to monitor, back up data, and maintain baselines so you can recognize anomalies and respond effectively rather than scrambling on the fly. Once preparation is in place, you can move smoothly into detection and analysis, then containment, eradication and recovery, and finally post-incident activity to learn and improve.