Which elements belong to an incident response plan?

• A. Preparation, detection and analysis, containment, eradication, recovery.
• B. Preparation, detection, and reporting only.
• C. Detection and containment only.
• D. Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Answer: (D)

An incident response plan is a set of coordinated actions that guide an organization from being prepared to learning and improving after an incident. The strongest option includes six key elements: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Preparation sets up the team, roles, policies, and training so you’re ready to act. Detection and analysis involve spotting incidents and understanding their scope and impact. Containment aims to limit the spread and further damage. Eradication removes the threat from the environment. Recovery focuses on restoring normal operations and ensuring systems are secure. Finally, post-incident lessons learned review what happened, what worked, and what didn’t, feeding those insights back into updating the plan and controls.

The other options miss important parts. Some omit the after-action lessons that drive continuous improvement, while others leave out essential phases like containment, eradication, or recovery, leaving the plan incomplete for effectively handling incidents.