Incident Management · Lesson 12 of 13
Coordinate investigation, containment, and recovery
23 minutes · Content checked 2026-10-17
AI editorial review completed — introductory draft; detailed revised-exam mapping unverified. Target edition: exams from 3 November 2026. Detailed revised-syllabus alignment remains pending.
Read the coverage and AI editorial review report
Loading progress…
Completion records your selection; it does not certify understanding or exam readiness.
What you will learn
- Prioritize incidents using business impact.
- Coordinate evidence handling and containment decisions.
- Communicate confirmed facts and uncertainty.
Balance urgent action and evidence
Containment should limit harm while considering service impact, attacker activity, and the need to investigate. Use authorized procedures and appropriate specialists. In some situations rapid isolation is essential; in others an indiscriminate shutdown could create additional operational or safety consequences.
Preserve relevant records and document who collected, accessed, or transferred them. Follow the organization's evidence-handling process and obtain specialist advice when needed. Do not promise that a particular collection method will satisfy every legal proceeding or jurisdiction.
Recover with decision criteria
Address the cause of compromise and validate the recovery environment before returning the service to normal operation. Coordinate restoration priorities with business owners and monitor for recurrence. Restoration of a server does not by itself prove the service is trustworthy or usable.
Communications should distinguish confirmed facts from estimates and unknowns. Use approved channels and spokespersons. Have the responsible specialists assess applicable notification obligations; timing and recipients depend on the facts and governing requirements, not a universal deadline.
Move from an event to a coordinated response
An observed event or alert is an input to triage, not automatically a confirmed incident. Reports can come from staff, suppliers, monitoring, or service failures. Assess credibility, relevant assets, potential impact, and available evidence using defined criteria. Record suspected as well as confirmed facts and escalate promptly where the evidence or potential consequence warrants it.
Select investigative tools for the question being answered and the responder's authorization. Record collection time, source, handling, and integrity checks appropriate to the evidence. Preserve original records where required and control access. Specialist advice and the actual applicable requirements determine legally appropriate handling; a particular tool or hash alone is not a guarantee of admissibility.
Plan eradication, recovery, and communications
After effective containment, identify and address the compromise path and affected scope. Authorized actions may include removing persistence, correcting exposed configurations, replacing affected components, or rotating compromised credentials. Choose actions based on the investigation and business consequences; do not destroy needed evidence merely to make the service appear clean.
Define who needs updates, which facts they need, who approves the message, and which channels remain available. Coordinate legal or contractual notification assessment with the responsible specialists. Before returning to normal operation, verify recovery integrity, required controls, usable business service, and monitoring for recurrence.
Work through a scenario
A team wants to restore a compromised application from backup immediately because customers are waiting. What should the coordinator confirm?
Compare your reasoning
Confirm the approved recovery criteria, the integrity of the recovery source, treatment of the compromise path, necessary evidence preservation, business priority, and authority to return the service.
Restoring quickly without addressing the cause may recreate the incident. The decision also needs to reflect the business consequences of delay.
Worked exercise: Classify an incident and balance containment
Fictional facts for learning. These assumptions and thresholds apply only to this exercise. Try the tasks before opening the worked solution.
- Exercise severity rules
- Critical: material critical-service interruption, confirmed major unauthorized disclosure, or credible safety impact. High: confirmed compromise with limited known impact. Medium: suspicious activity without confirmed compromise. Reassess as evidence changes.
- Current facts
- Confirmed administrator compromise on ordering; no outage or disclosure yet established. Investigation suggests possible ongoing unauthorized access.
- Decision
- Isolate all ordering immediately or restrict the compromised identity and affected paths while investigating. Effectiveness and business impact must be assessed.
Your task
- Classify the current evidence using these fictional rules.
- Specify evidence, communications, and recovery decisions.
Show worked solution
- The stated facts initially fit High, with urgency and potential escalation. Investigate scope and reassess promptly; absence of proven loss is not proof of low impact. These categories are illustrative organization-specific rules, not ISACA or NIST universal severity levels.
- Use authorized responders to assess effective containment and operational consequences. Preserve relevant access records and a decision timeline. Identify available evidence sources and retention before choosing tools; do not assume that collecting every log is necessary or proportionate.
- The coordinator needs a decision owner, containment rationale, specialist support, and a cadence for updates. Explain confirmed facts and unknowns to business owners; have responsible specialists assess actual notification obligations. Require evidence-preservation, compromise-path treatment, recovery validation, and business approval before normal operation resumes.
This exercise is not scored and does not contribute to an exam-readiness result.
Applied study · Added 2026-10-22
Contain with an explicit evidence and business tradeoff
Continue beyond the introduction. Work through the evidence before opening the model answer.
See it · Try it · Recall it
Picture the topic
Remember this: A tool observation needs context and corroboration.
Explore the anchors
Collect relevant trustworthy observations.
Concept matching activity
Match this task or description to its concept:
Correlate evidence and identify uncertainty.
Choose a concept before checking the explanation.
Detection laboratory
Positive means the detector raised an alert. True/false compares that decision with known reality.
False negative — An attack exists. No alert was raised.
| Detector | Attack present | No attack |
|---|---|---|
| Alert | True positive | False positive |
| No alert | False negative | True negative |
Change the threshold
Eight fictional events have fixed known truth. An alert fires when the synthetic score is at least the threshold. The score is not a probability of attack.
TP 2 · FP 1 · FN 2 · TN 3. Precision 67%. Recall 50%.
Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). Lower thresholds can increase detection and false alarms; this tiny dataset does not establish real-world performance.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
Visual recap for topic 4B1. Open its full syllabus chapter.
Make reversible decisions with recorded assumptions
Containment aims to limit harm while accounting for business and safety consequences. Document the decision-maker, evidence available, expected impact, action and reassessment point. Preserving volatile evidence can be valuable, but it is not an absolute reason to leave an actively harmful system connected. Follow authority and urgency. Distinguish established facts from hypotheses in incident updates so leadership can act without confusing confidence with certainty.
Verify trust before restoring normal operation
Recovery includes correcting the access path, handling exposed identities, validating system integrity and confirming the business service. A clean malware scan alone may not address stolen sessions, supplier access or unauthorized configuration. Set monitored return-to-service criteria and rollback conditions. Preserve evidence and chain-of-custody information according to the investigation process, and coordinate legal, communications and service owners without sharing sensitive evidence unnecessarily.
Evidence case
Fictional facts for learning; no real organization or person is described.
- A payment server is actively sending unauthorized instructions.
- Disconnecting it will interrupt legitimate processing; the plan delegates emergency isolation to the incident commander.
Your task
- Explain the decision tradeoff.
- List evidence and recovery conditions to record.
Compare with the model answer
The commander should evaluate the ongoing harm and use the delegated containment authority, coordinating a business workaround where available. Record the observed activity, timing, decision and impact; preserve evidence when feasible without allowing avoidable harm. Before reconnection, address the access path and credentials, validate configuration and reconcile affected payment activity through authorized owners.
This case has two original scenario questions in the expanded practice bank. Practice this course · Edition, coverage and remaining study
Key terms
- Containment
- Action intended to limit the spread or impact of an incident.
- Incident record
- A maintained account of evidence, decisions, actions, and changes in understanding.
Remember
- Reassess severity as evidence changes.
- Coordinate authority and specialist support.
- Validate recovery and monitor for recurrence.
Check your understanding
Why distinguish confirmed facts from estimates in an incident update?
Show explanation
It helps decision makers act appropriately without treating uncertain conclusions as established evidence.
Further reading
Examples and explanations are original learning material. These links provide background guidance; they do not certify exam coverage.
Found something unclear or inaccurate? Report a content correction.