What is an incident response plan and what are its typical steps?

• A. A plan for creating and marketing software features.
• B. A plan for data backups and disaster recovery.
• C. A plan for hiring and budgeting.
• D. A plan for detecting, containing, eradicating, and recovering from security incidents, including preparation, detection, containment, eradication, recovery, and lessons learned.

Answer: (D)

An incident response plan is a structured, repeatable process for handling security incidents so you can detect them quickly, contain their impact, remove the threat, and restore normal operations while learning from the event. It typically covers preparation (team roles, communication plans, and playbooks), detection and analysis (monitoring, alert triage, and incident classification), containment (short-term actions to limit spread), eradication (removing the threat and cleaning affected systems), recovery (restoring services and validating systems are clean), and lessons learned (post-incident review to improve defenses and responses). This sequence helps ensure incidents don’t escalate, evidence is preserved for forensics and legal needs, and defenses get strengthened over time. The other options describe activities outside the full scope of incident response: planning for feature development, birth of data backups and disaster recovery (which are broader business continuity concerns), or HR and budgeting tasks. While backups and DR are important and can support recovery, they do not by themselves constitute an incident response plan.