QuestionQ184Verified/Security OperationsCopy linkReport a problemAsk AstroTutorSave questionWhat is the FIRST action the Incident Response team should take when it suspects an incident?AChoose a containment strategy.BRecord all facts regarding the incident.CAttempt to identify the attacker.DNotify management of the incident.Show AnswerAnswerExplanationIncident responders should immediately document all known facts, observations, communications, and actions. A contemporaneous record preserves evidence, supports accurate analysis and coordination, and creates an auditable incident timeline. NIST guidance specifically directs teams to start recording all facts as soon as an incident is suspected.Learn moreNIST SP 800-61 Rev. 1, Computer Security Incident Handling GuideShow comments4Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion