Contain, preserve, and recover | CySA+: analysis and response in production

Concept and mechanism

Response begins with preparation, responsibilities, and decision criteria. NIST SP 800-61 Rev.3 integrates these activities into CSF 2.0 and treats learning as continuous; the teaching sequence of analysis, containment, eradication, and recovery does not require a linear process without revisiting steps. Containment limits spread and harm, while eradication addresses persistence and entry paths. Recovery must establish both trust and business function. An integrity-checked image does not invalidate a compromised credential or prove correct reconciliation. Scope can expand as new facts appear, requiring revised decisions and clear communication of what remains unknown.

Guided application

In a fictional scenario with active exfiltration, a playbook authorizes bounded isolation and other instances maintain capacity. Apply containment and confirm its result while recording times and coordinating collection. Do not wait for a full forensic image while harm continues that you can contain within authorization. In another context, already isolated and stable, the team can collect volatile memory before rebooting. The criterion depends on risk and the plan rather than an absolute rule. Preserve origin, actions, handlers, and transfers: a hash supports integrity but does not replace chain of custody. Before opening, remediate identities and causes, validate backups, rehearse critical functions, and monitor the restored system. Afterward, convert gaps into actions with owners, deadlines, and completion evidence.

IN PRACTICE

Isolated host with persistence on disk: containment applied, eradication still pending.

Common pitfalls

Isolation as eradication; hash as custody; recent backup as clean; login as complete recovery; presumed cause as fact.

Related topics: Telemetry, identity, and hunting · AI and automation in security operations · Assess vulnerabilities and coverage

Take this idea with you

Connect each phase to evidence and operational criteria.

Create account

Reference: Incident response within cybersecurity risk management · CS0-004 / CySA+ V4, launched 2026-06-23