The classic NIST incident response lifecycle has four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity. NIST SP 800-61 Rev. 3 now maps those phases onto the six CSF 2.0 Functions, but exam questions still ask you to place an activity in the right phase.
The phases and what belongs in each
Preparation is the work done before any incident. SP 800-61 Rev. 3 maps it to the Govern, Identify and Protect Functions, and lists activities such as keeping current, automatically updated inventories of hardware, software and data.
Detection and Analysis maps mainly to Detect. An incident is declared when adverse events meet the organization's defined incident criteria, after applying those criteria to the analyzed activity and setting aside known false positives.
Containment, Eradication and Recovery maps to Respond and Recover. Containment prevents the incident from expanding. Eradication removes persistence and entry points, such as deleting malware, disabling breached user accounts, and fixing every exploited vulnerability. Recovery restores the affected assets and operations.
Post-incident activity and lessons learned
SP 800-61 Rev. 3 says improvements are often identified by holding lessons learned meetings as recovery is concluding. The meeting reviews what happened, what actions were taken, and how effective those actions were.
Rev. 3 also says lessons should often be shared as soon as they are identified, not held until recovery ends. In its model, lessons from every Function feed the Improvement Category of Identify.
Worked example
A SIEM raises a cluster of alerts. The analyst discards the known false positives and finds the rest meets the incident criteria: that is detection. The team moves the infected hosts to an isolated network: containment. It deletes the malware and patches the exploited flaw: eradication. It restores services: recovery. As recovery ends, it meets to review what worked: lessons learned.
Where the exam catches people
Believing asset inventories are a detection activity: keeping them current is preparation, done before any incident.
Believing eradication comes before containment: containment stops the spread first, then eradication removes the cause.
Believing every alert is an incident: an incident is declared only when analyzed activity meets the defined criteria, after known false positives are excluded.
Believing lessons learned may only be gathered after recovery: Rev. 3 says lessons should often be shared as soon as they are identified.