After classification and priority assignment, what is the next step in the standard incident reporting flow?

After classification and priority assignment, what is the next step in the standard incident reporting flow?

• A. Recovery
• B. Triage
• C. Containment
• D. Eradication/Remediation

Answer: (C)

Containing the incident is the immediate next action after you classify what happened and assign its priority. The main goal at this stage is to stop further damage and prevent the attacker from moving laterally or exfiltrating data while you plan your next moves. This means isolating affected systems, blocking attacker access, restricting network paths, disabling compromised credentials, and applying short-term safeguards to keep the incident from spreading. Once containment is in place, you can move on to eradication/remediation—removing the root cause, cleaning up artifacts, applying fixes or patches, and closing the vulnerability that allowed the incident. After those steps, you focus on recovery—restoring services and operations to normal, validating that systems are safe, and monitoring for any reoccurrence. Triage is part of the initial assessment to gauge impact and prioritize actions, but the immediate next step after classification and priority is containment.

Containing the incident is the immediate next action after you classify what happened and assign its priority. The main goal at this stage is to stop further damage and prevent the attacker from moving laterally or exfiltrating data while you plan your next moves. This means isolating affected systems, blocking attacker access, restricting network paths, disabling compromised credentials, and applying short-term safeguards to keep the incident from spreading.

Once containment is in place, you can move on to eradication/remediation—removing the root cause, cleaning up artifacts, applying fixes or patches, and closing the vulnerability that allowed the incident. After those steps, you focus on recovery—restoring services and operations to normal, validating that systems are safe, and monitoring for any reoccurrence. Triage is part of the initial assessment to gauge impact and prioritize actions, but the immediate next step after classification and priority is containment.