Last updated:
CISSP decision trap
What are the CISSP incident response steps?
Direct answer
The ISC2 CISSP outline (Domain 7, objective 7.6) lists seven incident management steps: detection, response, mitigation, reporting, recovery, remediation and lessons learned. In a question, work out which step the scenario has reached and choose the action that step needs now. Containing active harm comes before rebuilding, and evidence is preserved while you contain. Reporting follows the incident plan and any legal duty, so it can run alongside the other steps.
incident response sequence: a practical decision framework
| Check | How to use it |
|---|---|
| Objective | Locate the scenario in preparation, detection, response, recovery, or post-incident work and identify what must be protected now. |
| First move | state the confirmed facts, current phase, decision owner, and immediate objective |
| Common trap | Eradicating or rebuilding before evidence, scope, containment, authorization, and business impact are addressed. |
incident response sequence in practice
An analyst confirms active exfiltration from a critical server while volatile evidence remains available and the approved plan defines isolation authority.
Follow authorized containment while preserving the required evidence and coordination. A root-cause project or immediate rebuild does not meet the present objective.
The seven steps and what each one does
Each step has a different goal, so the right answer depends on which goal the scenario needs now.
The outline lists the steps without a fixed script for every case. Use them to locate the scenario, then read the stem for what the organization's plan and authority allow.
- Detection: recognize that an event is an incident and confirm its scope.
- Response: activate the incident plan and team, and start the actions the plan authorizes.
- Mitigation: contain the incident to limit the damage, for example by isolating an affected system.
- Reporting: inform management, and anyone the law, a contract or policy requires, when the plan says.
- Recovery: restore systems and services to normal operation.
- Remediation: remove the root cause so the incident cannot recur the same way.
- Lessons learned: review what happened and update the plan, controls and training.
How to choose the next step in a question
Name the current step, the person deciding and what is still at risk.
An option that skips a step, such as restoring a system before the incident is contained, is usually the distractor.
- If harm is still spreading, containment comes before investigation or rebuilding.
- If volatile evidence exists, preserve it as part of containment, not after the rebuild.
- If the stem asks what to do FIRST, look for the earliest step that has not happened yet.
The common mistake: jumping straight to the fix
Rebuilding, patching or hunting for the root cause can sound responsible while harm is still spreading.
Remediation removes the cause, but it comes after containment. A rebuild during an active compromise can destroy evidence and leave the attacker's other footholds in place. Choose the action that limits harm now, within the authority the plan gives.
Practise the order on a changed scenario
Move the scenario to a different step and check that your answer moves with it.
- Malware is confirmed and still spreading: contain it.
- Customers' personal data was exposed: report it as the plan and the law require, alongside containment.
- The incident is closed: hold a lessons-learned review and update the plan.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What are the CISSP incident response steps?
The ISC2 CISSP outline (Domain 7, objective 7.6) lists seven incident management steps: detection, response, mitigation, reporting, recovery, remediation and lessons learned. In a question, work out which step the scenario has reached and choose the action that step needs now. Containing active harm comes before rebuilding, and evidence is preserved while you contain. Reporting follows the incident plan and any legal duty, so it can run alongside the other steps.
Does the CISSP use the NIST incident response steps?
The CISSP outline uses its own list of seven steps. NIST's incident handling guidance groups the work differently, so learn the outline's terms for the exam and read each scenario for what has already happened.
Is mitigation the same as containment?
The outline lists mitigation without defining it. In practice it is the step where you limit the damage, and containment, such as isolating a system, is the usual way to do it.
When should an incident be reported?
When the incident plan, the law, a regulator or a contract requires it. Reporting is a step of its own, but notification deadlines often run while containment and recovery continue.
Why not rebuild the affected system straight away?
A rebuild can destroy evidence and leave other footholds in place. Contain the incident and preserve evidence first, then recover and remove the cause as the plan directs.
