The seven NIST incident response phases, in plain English
CompTIA Security+ tests the NIST incident response phases as a seven-step sequence: Preparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons Learned. NIST SP 800-61r2 itself groups them into four, but the exam breaks them out as seven distinct phases because the order is what most questions hinge on. Get the order right and most scenario questions answer themselves.
Why CompTIA breaks the NIST lifecycle into seven phases
NIST SP 800-61 Revision 2 is the canonical reference for incident handling. NIST itself groups the lifecycle into four buckets: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. CompTIA Security+ pulls those buckets apart and tests them as seven distinct phases. The split makes pedagogical sense. Each phase has a different goal, a different decision, and a different correct next action, so collapsing them hides the test point.
SANS publishes a similar model called PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons learned. SANS combines detection and analysis into a single Identification step. CompTIA splits them. Memorize the seven-phase version for the exam. The phases also map cleanly to the NIST Cybersecurity Framework Respond and Recover functions, so the same language shows up later in any compliance or audit role you sit in.
The phases are not always strictly linear in real life. Teams loop back to analysis when new evidence surfaces, bounce between containment and eradication, and sometimes restart detection on a related incident. On the exam, treat the order as canonical. In the seat, treat it as a strong default.
Phase 1: Preparation
Preparation happens before any incident. This is the phase most organizations underspend on, which is why it shows up on the exam. The work is unglamorous: write the incident response plan, build the team roster, document the playbooks, deploy the tooling, train the staff, run the tabletop exercises. None of it gets attention until the day it saves the organization.
Concrete preparation outputs include a documented IR plan, a named IR team with backups, per-incident-type playbooks (phishing, ransomware, lost device, insider), tested tooling like EDR with isolation and SIEM with correlation rules, and a quarterly tabletop cadence. The exam likes to test the difference between tabletop exercises (discussion only, quarterly, finds planning gaps) and simulations (sandboxed walk-through, annual, finds tool and coordination gaps). Both are required.
Phase 2: Detection
Detection is the trigger. Something fires. A SIEM correlation rule trips on a burst of failed logons. EDR flags a process executing from a temp directory. A user reports a strange email. An external party (a threat intel feed, a partner, sometimes the FBI) notifies you. The phase ends with an open ticket and an analyst assigned.
Detection alone does not confirm an incident. A SIEM alert is a hypothesis. The detection phase ends when the alert exists and someone owns it. The next phase decides whether it is real.
Phase 3: Analysis
Analysis is where the team confirms the incident is real, scopes the blast radius, and classifies severity. This is where most teams misstep. The pressure to do something pushes analysts toward containment before they understand the scope. Containing one host while ten others are still talking to the attacker buys nothing.
A clean analysis phase answers three questions before any containment action. What is happening (the technique and the target). How bad is it (how many hosts, which data, which accounts). How fast does it spread (active lateral movement, dormant foothold, automated ransomware). Once those three answers exist, the team can make a containment plan that actually works.
Phase 4: Containment
Containment stops the spread. The exam tests two flavors. Short-term containment is the minutes-scale move: isolate the host through EDR, disable the compromised account, block the malicious domain at the firewall. Long-term containment is the architectural move: route around the affected segment, deploy a workaround, harden the perimeter so the attacker cannot regain access while eradication runs.
Order matters. Contain before you eradicate. If you start deleting malware while the attacker still has an active session, you tip them off and they pivot or wipe logs. Containment buys the time eradication needs. The other order-of-operations rule the exam loves: do not power off compromised hosts. Memory holds running processes, network sessions, and unencrypted strings that vanish on power-off. Use EDR isolation instead.
Phase 5: Eradication
Eradication removes the threat. Kill the malicious processes. Delete the malware files. Disable or delete the compromised accounts. Rotate any credentials that were exposed. Patch the vulnerability the attacker used to get in. Rebuild affected hosts from a known-good baseline image when reimaging is the only way to be sure.
Containment without eradication means the attacker comes back tomorrow. The isolated host is still infected. The disabled account is still compromised in the identity provider. The blocked domain is one DNS change away from being live again. Eradication is the phase that actually closes the door, not the phase that just slams it shut.
Phase 6: Recovery
Recovery brings systems back online. Restore from clean backups (this is where immutable backup discipline pays off). Validate the restored systems are actually clean. Return them to production with enhanced monitoring for the first stretch in case anything was missed. The phase is declared closed when leadership signs off, not when the host boots.
Heightened monitoring during early recovery catches the most common failure mode: a foothold the team missed during eradication. EDR alerting on the recovered host should be tighter than normal for the first week or two. If anything fires, the team loops back to analysis with new evidence.
Phase 7: Lessons Learned
Lessons learned is the phase most teams skip, which is why it shows up on the exam. The post-incident review (PIR) belongs on a calendar before the incident bridge closes, not as a vague "we will get to it." NIST recommends within two weeks while the details are fresh. The review answers what worked, what did not, what gets updated in the playbook, what tooling needs investment, what training the team needs.
The phase produces concrete artifacts: an updated IR plan, updated playbooks, new detection rules, new training topics, new tabletop scenarios. Without those artifacts, the same incident lands the same way next time. The PIR is what turns one bad day into a stronger program. It is the phase that makes the next response better.
A real ransomware response timeline
The seven phases are easier to remember when you walk a real incident through them. Here is what a clean response looks like for a ransomware hit at a mid-size healthcare organization.
How Security+ tests this on the exam
Three question shapes dominate the exam for this objective. Phase identification questions hand you an action ("a SOC analyst isolated the host from the network through EDR") and ask which phase the team is in. Correct ordering questions ask which phase comes next. Distinction questions test pairs that learners commonly confuse, especially containment versus eradication and short-term versus long-term containment.
The reliable test-day move is to ask yourself two questions before you answer. Is the spread stopped yet? If no, the analyst is somewhere in detection, analysis, or containment. Is the threat removed yet? If no, the analyst is in containment, not eradication. Walk those two questions through any scenario stem and the phase usually pops out.
Drill the lesson and the matching practice set if you want this locked in. The full Security+ objective lives at SP-4.8 Incident response. The companion objective SP-4.9 Data sources to support an investigation covers the log types you pull during the analysis and eradication phases. A full-length sit on the Practice Exam mode is the fastest way to see how CompTIA actually phrases these.
Where to go next
If you are tracking toward Security+ specifically, the Security+ track page has the full objective map and what each domain covers. If you are already in the platform, head to the dashboard and review Domain 4 in the Mastery Index with its evidence-quality label.
Questions about your specific path? Email the team. We reply personally, usually within a day.
Sources
- NIST. SP 800-61 Revision 2 Computer Security Incident Handling Guide. The canonical NIST lifecycle (Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity) the seven CompTIA phases derive from.
- CISA. Cybersecurity Incident Response (Federal Government Incident Response Playbook). CISA's operational guidance for incident response across federal and critical infrastructure, mapped to the same NIST phases.
- SANS. Incident Handler's Handbook (PICERL model). The SANS six-step model (Preparation, Identification, Containment, Eradication, Recovery, Lessons learned) that combines NIST's Detection and Analysis into a single Identification step.
About the authors
IT Service Center Manager and former CTE / IT teacher. Owner of Revtek in Chicago's south suburbs. Writes everything that ships under his name and reviews every line of Revy-assisted drafting before publish.
LinkedIn ↗Revy helps draft and structure these posts. Every piece is reviewed, edited, and fact-checked by Nick before publish. We disclose this here because it is the right thing to do. See the AI Policy for the full stance.