Domain 5 · Objective reference 5.3 · Chapter 17 of 19
Incident response plans, handling and exercises
About 5 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Contain the incident before trusting recovery.
Explore the anchors
Agree authority tools and escalation.
Concept matching activity
Match this task or description to its concept:
Investigate and contain with evidence.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Use the plan to coordinate people and actions
- Exercise the capability being claimed
Use the plan to coordinate people and actions
Preparation establishes roles, contacts, evidence handling, tools, decision authority and links to continuity arrangements. Detection and analysis establish what is observed and how urgent it is. Containment limits harm; eradication addresses the cause or continuing malicious presence; recovery returns a service to a trusted usable state. Learning feeds improvements back into preparation. These activities may overlap and iterate rather than form a rigid sequence in every incident.
A plan should specify who can isolate a critical system, authorize a workaround and approve internal or external communication. Use current applicable reporting requirements through qualified owners. An analyst should not independently publish a breach announcement or destroy evidence merely because one alert appears severe.
Exercise the capability being claimed
A tabletop examines decisions and coordination through discussion. A simulation or technical exercise can test selected operational behavior under controlled conditions. A restore exercise may measure actual restoration, while a tabletop alone does not prove a recovery-time result. Define objectives, participants, safety limits, expected evidence and stop conditions.
During an incident, preserve evidence where feasible while limiting ongoing harm under authorized decisions. Record source, collection method, time and handling. After recovery, identify contributing conditions and assign corrective actions with owners, deadlines and retests. Update playbooks for relevant automated-service dependencies and human escalation rather than assuming an AI summary replaces the incident commander’s accountability.
Worked example
A suspicious administrator session is contained under the response plan. The team preserves relevant records, revokes surviving access, validates recovery and later tests the corrected access-control path. It does not treat removal of one malicious file as complete recovery.
Check your understanding
An exercise reveals that nobody can authorize a supplier shutdown at night. What makes the follow-up action verifiable?
Show explanation
Assign an owner to approve out-of-hours authority and contacts, set a deadline, brief the affected teams and run a follow-up exercise that demonstrates the decision route works.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.