3.3 Explain the preparation and post-incident activity phases of the incident management life cycle

📘CompTIA CySA+ (CS0-003)

Preparation & Post-Incident Activities

Incident management is not only about responding to attacks. A strong cybersecurity program focuses heavily on:

Preparation (before incidents happen)
Post-incident activities (after incidents are handled)

These two phases ensure the organization is ready, responsive, and continuously improving.

1. Preparation Phase (Before an Incident Happens)

Preparation is the most important phase because it reduces damage and improves response speed during a real incident.

1.1 Incident Response (IR) Plan

An Incident Response Plan is a documented guide that explains:

What counts as a security incident
Who responds to incidents
Steps to follow during an incident
Communication process
Escalation procedures

IT Example:

In a company network:

If ransomware is detected on a workstation, the IR plan defines:
- Who isolates the system (SOC analyst)
- Who informs management
- How evidence is collected
- When legal/compliance teams are involved

👉 Exam point: IR plan ensures a structured and consistent response.

1.2 Tools Used in Incident Response

Organizations prepare a set of tools before incidents happen.

Common IR tools include:

SIEM (Security Information and Event Management) → collects logs (e.g., Splunk, QRadar)
EDR/XDR tools → detect malware on endpoints (e.g., CrowdStrike, Microsoft Defender for Endpoint)
Packet capture tools → analyze network traffic (e.g., Wireshark)
Forensic tools → investigate compromised systems
Ticketing systems → track incidents (e.g., ServiceNow)

IT Example:

A SIEM tool alerts:

Multiple failed login attempts from an unknown IP address

The SOC team uses EDR to check if any endpoint is compromised.

👉 Exam point: Tools help with detection, analysis, containment, and investigation.

1.3 Playbooks

A playbook is a step-by-step procedure for handling a specific type of incident.

Each playbook includes:

Trigger conditions (what activates it)
Step-by-step response actions
Tools to use
Roles and responsibilities
Escalation steps

Common Playbooks:

Malware infection
Phishing attack
DDoS attack
Data breach
Insider threat

IT Example:

A phishing playbook may include:

Identify malicious email
Remove email from all user inboxes
Block sender domain in email gateway
Reset affected user credentials
Investigate click activity

👉 Exam point: Playbooks ensure fast, consistent, repeatable response.

1.4 Tabletop Exercises

A tabletop exercise is a discussion-based simulation of an incident.

No real systems are used
Teams walk through “what would you do if…”
Helps test decision-making and communication

IT Example:

Scenario:

“A ransomware attack encrypts the file server”

Teams discuss:

Who disconnects the server?
Who contacts leadership?
How backups are restored?

👉 Exam point: Tabletop exercises test preparedness without real risk.

1.5 Training

Training ensures that staff know how to respond during incidents.

Types of training:

Security awareness training (all employees)
SOC analyst technical training
Incident response team training
Tool-specific training (SIEM, EDR)

IT Example:

Employees are trained to:

Identify phishing emails
Report suspicious login alerts
Follow incident reporting procedures

SOC analysts are trained to:

Analyze logs
Investigate alerts
Use forensic tools

👉 Exam point: Training reduces human error and improves response speed.

1.6 Business Continuity (BC) and Disaster Recovery (DR)

BC and DR ensure business operations continue even during major incidents.

Business Continuity (BC)

Focus:

Keep critical business functions running

Disaster Recovery (DR)

Focus:

Restore IT systems after a failure or attack

IT Examples:

BC Example:

If email server is down:

Employees switch to backup communication platform (like Teams or Slack)

DR Example:

After ransomware attack:

Restore encrypted files from backup systems
Rebuild servers using clean images

👉 Key terms:

RTO (Recovery Time Objective): how fast systems must be restored
RPO (Recovery Point Objective): how much data loss is acceptable

👉 Exam point: BC/DR ensures minimal downtime and data loss.

2. Post-Incident Activities (After Incident Handling)

After an incident is resolved, organizations focus on learning and improving.

2.1 Lessons Learned

A formal review is conducted to analyze:

What happened?
How was it detected?
What worked well?
What failed?
How can response be improved?

IT Example:

After a phishing attack:

Review why email filter did not block it
Check why user clicked the link
Improve training and email filtering rules

👉 Exam point: Lessons learned improve future defense.

2.2 Reporting and Documentation

All incident details are documented:

Timeline of events
Affected systems
Attack method
Actions taken
Evidence collected

IT Example:

A report may include:

Malware detected at 10:05 AM
System isolated at 10:10 AM
Malware removed at 11:00 AM

👉 Exam point: Documentation is required for compliance and audits.

2.3 Evidence Preservation Review

After incident closure:

Ensure evidence is stored securely
Maintain chain of custody records
Confirm forensic data is intact

👉 Exam point: Evidence may be needed for legal or compliance investigations.

2.4 Process Improvement

Organizations update security controls:

Improve firewall rules
Update SIEM detection rules
Patch vulnerabilities
Improve playbooks and IR plans

IT Example:

If attackers used weak passwords:

Enforce MFA (Multi-Factor Authentication)
Strengthen password policy

👉 Exam point: Continuous improvement strengthens security posture.

Final Exam Summary

Preparation Phase Includes:

Incident Response Plan
Security Tools (SIEM, EDR, forensic tools)
Playbooks (step-by-step response guides)
Tabletop Exercises (simulated incidents)
Training (staff readiness)
Business Continuity and Disaster Recovery

Post-Incident Phase Includes:

Lessons learned review
Incident reporting and documentation
Evidence preservation
Process and security improvements

Key Exam Takeaway

Preparation = readiness before attack
Post-incident = learning and improving after attack
Both phases ensure a faster, stronger, and more mature cybersecurity response system