Which set of core phases is described in the NIST incident response lifecycle?

• A. A plan to avoid all future incidents by preventing any intrusion.
• B. A framework for collecting digital evidence only; no response steps.
• C. An IT governance process focusing on asset management.
• D. Preparation, Detection and Analysis, Containment, Eradication, Recovery, Lessons Learned.

Answer: (D)

NIST's incident response lifecycle is a structured, repeatable process for handling security incidents, and it includes six phases: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Lessons Learned. Preparation builds the foundation—defining roles, establishing communication plans, assembling tools, and training the team so action can be taken quickly when an alert arrives. Detection and Analysis is where alerts are triaged, the incident is scoped, and the potential impact is understood to guide the response. Containment focuses on stopping the spread of the incident, choosing strategies that minimize damage while keeping systems available when possible. Eradication means removing the root cause, fixing exploited vulnerabilities, and cleansing affected environments. Recovery is about restoring normal operations, validating that systems are clean, and monitoring to ensure there’s no reoccurrence. Lessons Learned is a post-incident review that feeds back into improved detection, remediation steps, and updated policies, playbooks, and defenses for future incidents. The other options describe aims outside this lifecycle—either trying to prevent every incident, focusing only on collecting evidence, or emphasizing governance tasks—so they don’t capture the full, actionable sequence defined by NIST.