What are the essential steps in OIMS incident response?

What are the essential steps in OIMS incident response?

• A. Detect, contain, eradicate, recover; communicate with stakeholders; preserve evidence; perform post-incident review
• B. Isolate system only
• C. Ignore incident
• D. Notify external parties only

Answer: (A)

In incident response, you start by quickly detecting and assessing what happened, then act to limit damage by containing the incident, remove the threat through eradication, and restore normal operations during recovery. Communication with stakeholders is essential throughout to coordinate actions, manage expectations, and maintain trust. Preserving evidence is also crucial for forensics, investigations, and compliance, ensuring you have the data needed to understand what happened and why. After handling the incident, a post-incident review captures lessons learned to strengthen defenses and prevent recurrence. This combination covers the full lifecycle: detection, containment, eradication, recovery, clear communication, evidence preservation, and learning from the incident. The other options fall short because they address only a narrow piece—isolating a system misses the broader sequence; ignoring the incident is not acceptable; notifying external parties only omits the internal containment, eradication, and recovery actions necessary to stop the incident.

In incident response, you start by quickly detecting and assessing what happened, then act to limit damage by containing the incident, remove the threat through eradication, and restore normal operations during recovery. Communication with stakeholders is essential throughout to coordinate actions, manage expectations, and maintain trust. Preserving evidence is also crucial for forensics, investigations, and compliance, ensuring you have the data needed to understand what happened and why. After handling the incident, a post-incident review captures lessons learned to strengthen defenses and prevent recurrence.

This combination covers the full lifecycle: detection, containment, eradication, recovery, clear communication, evidence preservation, and learning from the incident. The other options fall short because they address only a narrow piece—isolating a system misses the broader sequence; ignoring the incident is not acceptable; notifying external parties only omits the internal containment, eradication, and recovery actions necessary to stop the incident.